The Acting US Attorney for SDNY, Danielle Sassoon, who was hand-picked by Trump’s people, resigned today rather than do the dirty bidding of Trump’s defense attorney (and disgruntled former SDNY AUSA) Emil Bove, by dismissing the case against Eric Adams.

After she resigned, two attorneys in DOJ’s Public Integrity Division, Kevin Driscoll and John Keller, joined her rather than dismiss the case.

A letter, yesterday, from Sassoon to Pam Bondi and another, today, from Bove to Sassoon document much of what happened.

Sassoon documents that Bove likened the dismissal of charges against Adams to the Viktor Bout prisoner exchange (something that was in his original letter).

Mr. Bove proposes dismissing the charges against Adams in return for his assistance in enforcing the federal immigration laws, analogizing to the prisoner exchange in which the United States freed notorious Russian arms dealer Victor Bout in return for an American prisoner in Russia. Such an exchange with Adams violates commonsense beliefs in the equal administration of justice, the Justice Manual, and the Rules of Professional Conduct. The “commitment to the rule of law is nowhere more profoundly manifest” than in criminal justice. Cheney v. United States Dist. Ct., 542 U.S. 367, 384 (2004) (alterations and citation omitted). Impartial enforcement of the law is the bedrock of federal prosecutions. See Robert H. Jackson, The Federal Prosecutor, 24 J. Am. Jud. Soc’y 18 (1940). As the Justice Manual has long recognized, “the rule of law depends upon the evenhanded administration of justice. The legal judgments of the Department of Justice must be impartial and insulated from political influence.” JM § 1-8.100. But Adams has argued in substance—and Mr. Bove appears prepared to concede—that Adams should receive leniency for federal crimes solely because he occupies an important public position and can use that position to assist in the Administration’s policy priorities.

[snip]

Adams’s advocacy should be called out for what it is: an improper offer of immigration enforcement assistance in exchange for a dismissal of his case. Although Mr. Bove disclaimed any intention to exchange leniency in this case for Adams’s assistance in enforcing federal law,1 that is the nature of the bargain laid bare in Mr. Bove’s memo. That is especially so given Mr. Bove’s comparison to the Bout prisoner exchange, which was quite expressly a quid pro quo, but one carried out by the White House, and not the prosecutors in charge of Bout’s case.

The comparison to the Bout exchange is particularly alarming. That prisoner swap was an exchange of official acts between separate sovereigns (the United States and Russia), neither of which had any claim that the other should obey its laws. By contrast, Adams is an American citizen, and a local elected official, who is seeking a personal benefit—immunity from federal laws to which he is undoubtedly subject—in exchange for an act—enforcement of federal law—he has no right to refuse. Moreover, the Bout exchange was a widely criticized sacrifice of a valid American interest (the punishment of an infamous arms dealer) which Russia was able to extract only through a patently selective prosecution of a famous American athlete.2 It is difficult to imagine that the Department wishes to emulate that episode by granting Adams leverage over it akin to Russia’s influence in international affairs. It is a breathtaking and dangerous precedent to reward Adams’s opportunistic and shifting commitments on immigration and other policy matters with dismissal of a criminal indictment. Nor will a court likely find that such an improper exchange is consistent with the public interest. See United States v. N.V. Nederlandsche Combinatie Voor Chemische Industrie (“Nederlandsche Combinatie”), 428 F. Supp. 114, 116-17 (S.D.N.Y. 1977) (denying Government’s motion to dismiss where Government had agreed to dismiss charges against certain defendants in exchange for guilty pleas by others); cf. In re United States, 345 F.3d 450, 453 (7th Cir. 2003) (describing a prosecutor’s acceptance of a bribe as a clear example of a dismissal that should not be granted as contrary to the public interest).

[snip]

In particular, the rationale given by Mr. Bove—an exchange between a criminal defendant and the Department of Justice akin to the Bout exchange with Russia—is, as explained above, a bargain that a prosecutor should not make. Moreover, dismissing without prejudice and with the express option of again indicting Adams in the future creates obvious ethical problems, by implicitly threatening future prosecution if Adams’s cooperation with enforcing the immigration laws proves unsatisfactory to the Department. See In re Christoff, 690 N.E.2d 1135 (Ind. 1997) (disciplining prosecutor for threatening to renew a dormant criminal investigation against a potential candidate for public office in order to dissuade the candidate from running); Bruce A. Green & Rebecca Roiphe, Who Should Police Politicization of the DOJ?, 35 Notre Dame J.L. Ethics & Pub. Pol’y 671, 681 (2021) (noting that the Arizona Supreme Court disbarred the elected chief prosecutor of Maricopa County, Arizona, and his deputy, in part, for misusing their power to advance the chief prosecutor’s partisan political interests). Finally, given the highly generalized accusations of weaponization, weighed against the strength of the evidence against Adams, a court will likely question whether that basis is pretextual. See, e.g., United States v. Greater Blouse, Skirt & Neckwear Contractors, 228 F. Supp. 483, 487 (S.D.N.Y. 1964) (courts “should be satisfied that the reasons advanced for the proposed dismissal are substantial and the real grounds upon which the application is based”).

1 I attended a meeting on January 31, 2025, with Mr. Bove, Adams’s counsel, and members of my office. Adams’s attorneys repeatedly urged what amounted to a quid pro quo, indicating that Adams would be in a position to assist with the Department’s enforcement priorities only if the indictment were dismissed. Mr. Bove admonished a member of my team who took notes during that meeting and directed the collection of those notes at the meeting’s conclusion.

2 See, e.g., https://thehill.com/homenews/3767785-trump-pans-prisoner-swap-brittney-grinerhates-our-country/.

In response, Bove suggested that DOJ was adopting an unreviewable judgement of “weaponization” in disciplining lawyers.

The weaponization finding in my February 10, 2025 memorandum was made pursuant to a policy set forth by President Trump, who is the only elected official in the ExecutiveBranch, in connection with a decision that was authorized by the Senate-confirmed Attorney General ofthe United States, and entirely consistent with guidance issued by the Attorney General shortly after that confirmation. Your Office has no authority to contest the weaponization finding, or the second independent basis requiring dismissal set forth in my memorandum. The Justice Department will not tolerate the insubordination and apparent misconduct reflected in the approach that you and your office have taken in this matter.

You are well aware of the Department’s weaponization concerns regarding the handling of the investigation and prosecution of Mayor Adams. Those concerns include behavior that supports, at minimum, unacceptable appearances of impropriety and the politicization of your office. The investigation was accelerated after Mayor Adams publicly criticized President Biden’s failed immigration policies, and led by a former U.S. Attorney with deep connections to the former Attorney General who oversaw the weaponization ofthe Justice Department. Based on my review and our meetings, the charging decision was rushed as the 2024 Presidential election approached, and asthe former U.S. Attorney appears to have been pursuing potential political appointments in the event Kamala Harris won that election.

I’ve been wondering for some time when Bove would wildly overstep with his aggressiveness. He’s now facing documentation that supports a quid pro quo seeking political favors. And in response, he suggested his recourse is to adopt a label — weaponization — with no due process.

Trump may yet get his quid pro quo (though Judge Dale Ho now has abundant reason to refuse to dismiss this case).

But he may lose DOJ as a result.

Update: Note that the same day Sassoon sent the letter to Bondi, Bondi sued Tish James. And as this was going on, Trump rescinded FEMA funding for NY.

Those likely are not unrelated.

Update: NYT has published the original letter instructing Sassoon to dismiss the case.

There have and will be a slew of lawsuits in response to Trump’s attack on government. But this lawsuit, from eight of the Inspectors General that Trump fired on January 24, has been much anticipated. [docket]

That’s partly because Congress just strengthened the laws protecting Inspectors Generals, in response to Trump’s firing of some in his first term, as the suit lays out.

63. Congress responded in 2022 by further amending the IG Act. The Securing Inspector General Independence Act of 2022, see supra ¶6, enacted by overwhelming margins in both houses of Congress, procedural protections before an IG can be removed or placed on nonduty status, designated that a “first assistant” would automatically replace an IG in the event of a vacancy, and required the President to communicate reasons for not making a formal nomination to fill an IG vacancy after a certain period of time.

64. The 2022 amendments also strengthened the procedural safeguards on removing an IG. Prior to the amendments, the IG Act had required the President to provide 30 days’ notice to both houses of Congress and “reasons for any such removal.” The 2022 amendments require the President to provide 30 days’ notice to both houses of Congress, including appropriate congressional committees, and to “communicate in writing the substantive rationale, including detailed and case-specific reasons, for any such removal.” 5 U.S.C. §403(b). With the 2022 amendments included, the relevant provisions now reads as follows:

An Inspector General may be removed from office by the President. If an Inspector General is removed from office or is transferred to another position or location within an establishment, the President shall communicate in writing the substantive rationale, including detailed and case-specific reasons for any such removal or transfer to both Houses of Congress (including to the appropriate congressional committees), not later than 30 days before the removal or transfer. Nothing in this subsection shall prohibit a personnel action otherwise authorized by law, other than transfer or removal.

65. These procedural provisions ensure that Congress or members of Congress can, if it or they deem it appropriate, seek to persuade the President not to go forward with a noticed removal. Indeed, the legislative history of the Inspector General Reform Act indicates that Congress added the notice requirement to “allow for an appropriate dialogue with Congress in the event that the planned transfer or removal is viewed as an inappropriate or politically motivated attempt to terminate an effective Inspector General.” See S. Rep. No. 110-262, at 4 (2008)

If Congress has any power to limit how the President fires someone, then this suit will uphold that power (a large team from Wilmer Cutler, led by former Solicitor General Seth Waxman, are representing the plaintiffs).

But it’s also because the plaintiffs in this suit embody everything Trump claims he wants to do with DOGE. Elon Musk claims he’s hunting for waste, fraud, and corruption in government agencies he’s wildly unfamiliar with. These civil servants have been doing this, some of them, for four decades.

Indeed, one thing the suit lists, for each of the plaintiffs, is how much material impact they have had in their role (with one exception, exclusively in the IG position from which they were fired, which the report explains is:

“Monetary impact” describes the estimated financial savings or losses that could result from implementing recommendations made in an IG’s audits, inspections, or evaluations, essentially quantifying the potential cost-benefit of addressing issues like waste, fraud, and abuse in a government agency or program. See CIGIE, Toolkit for Identifying and Reporting Monetary Impact, at 1 (June 18, 2024), https://www.ignet.gov/sites/default/files/files/Toolkit%20for%20Identifying%20and%20Reporting%20Monetary%20Impact.pdf.

Some monetary-impact estimates reported herein also consider monetary benefits associated with IG investigations.

And while there’s some inconsistency in the reporting (for example, Sandra Bruce included stuff from when she was Acting IG during Trump’s first term whereas some of the others left out susbstantial terms in other IG roles, Larry Turner’s number — for Department of Labor — seems quite high, and Mike Ware does not include $30 billion seized or returned pursuant to investigations he oversaw), the Inspectors General describe identifying $183.5 billion in material impact.

As noted in this post, that includes substantial work cleaning up after COVID relief rolled out by Trump, particularly from Mike Ware, work which lead DOGE Treasury Official Thomas Krause relied on to suggest that DOGE could be effective. In Ware testimony to Congress that Krause cited, Ware described up to $200 billion in fraud just in Small Business related relief alone.

Using OIG’s investigative casework, prior OIG reporting, advanced data analytics, and additional review procedures, we estimate SBA disbursed more than $200 billion in potentially fraudulent COVID-19 EIDLs and PPP loans. This estimate represents approximately 17 percent of disbursed COVID-19 EIDLs and PPP funds — specifically, more than $136 billion COVID-19 EIDLs and $64 billion in PPP funds. Since SBA did not have an established strong internal control environment for approving and disbursing program funds, there was an insufficient barrier against fraudsters accessing funds that should have been available for eligible business owners adversely affected by the pandemic.

That’s what Trump did by firing Ware and the others: halt proven efforts to do what DOGE is incapable of — and only pretending — to do.

Which is another reason to keep an eye on this lawsuit.

In the last few days, Trump has started doing a better job of messaging with his responses to lawsuits. I’ll attempt to explain that going forward. But one instance is the Thomas Krause declaration filed in the Attorneys General challenge to the DOGE access to Treasury systems (which I also wrote about in this post). Krause — still serving as the hatchet man CEO of Citrix (which probably creates a serious conflict) — uses his declaration to claim that he is attempting to “improve the accuracy of financial reporting.”

I am responsible, among other duties, for reducing and eliminating improper and fraudulent payments; waste, fraud, and abuse; and improving the accuracy of financial reporting. To that end, I am focused on improving the controls, processes, and systems that facilitate payments and enable consolidated financial reporting.

Later in the declaration, he provides a notably different explanation for his job.

My role on the Treasury DOGE Team is to find ways to use technology to make the Treasury Department more effective, more efficient, and more responsive to the policy goals of this Administration.

To justify the focus of DOGE, Krause cites several Biden-era GAO reports.

7. As illustrated by several reports released by the Government Accountability Office (GAO), we have our work cut out for us. On January 16, 2025, GAO released a report entitled “Financial Audit: FY2024 and FY2023 Consolidated Financial Statements of the U.S. Government.” In the report, GAO summarizes that they were not able to determine if the Financial Report of the U.S. Government is fairly presented. Among other reasons, GAO highlighted “problems in accounting for transactions between federal agencies.” GAO found many material weaknesses including “the federal government’s inability to determine the full extent to which improper payments, including fraud, occur and reasonably assure that appropriate actions are taken to reduce them.” GAO also reported that Treasury and Office of Management and Budget (OMB) officials expressed their continuing commitment to addressing the problems this report outlines. In short, the GAO report identifies the Federal government’s inability to account for all of the improper payments including waste, fraud and abuse across federal agencies.

8. On September 10, 2024, the GAO released a report entitled “Payment Integrity: Significant Improvements are Needed to Address Improper Payments and Fraud.” The report found that since 2003, cumulative improper payments1 by executive branch agencies have totaled about $2.7 trillion dollars. Some of GAO’s top concerns [1] included fraudulent or improper Earned Income Tax Credit refunds, Social Security payments, unemployment and Medicare and Medicaid payments. In fiscal year 2023 alone, federal agencies estimated $236 billion in improper payments across more than 70 federal programs. In addition, GAO estimated that the total annual financial losses across the government from fraud are between $233 and $521 billion. These numbers are truly staggering—billions and billions in hardearned American taxpayer dollars are being misspent every year. GAO highlighted a number of steps that Congress and federal agencies could take to help reduce fraud and improper payments, including that “[a]gencies should improve oversight to ensure that funds aren’t paid to ineligible recipients” [2] and that “[a]gencies should improve their collection and use of data for preventing and detecting fraud.” [3]

9. Similarly, GAO has identified areas for improvement in BFS’s systems related to identifying and tracing transactions to determine whether they were complete and properly recorded in the correct general ledger accounts and line items within the Schedules of the General Fund. See GAO Report, “Financial Statement Audit: Bureau of the Fiscal Service’s FY22 Schedules of the General Fund” (March 30, 2023). Specifically, GAO has found inconsistent reporting, lack of traceability, and need for improved controls with the Treasury’s Central Accounting and Reporting System (CARS), which federal agencies use to track their spending for budgetary and accounting purposes. These kinds of improvements and others can enhance BFS’s ability to ensure accountability in the spending of taxpayer dollars.

1 Improper payments and fraudulent payments are related but distinct concepts. An improper payment is a payment that should not have been made, or that was made with an incorrect amount; fraudulent payments occur due to willful misrepresentation. All fraudulent payments are improper, but not all improper payments are fraudulent. [emphasis and links added]

Elon Musk parroted a lot of this language at his presser at the White House yesterday (which is one reason I say they’re beginning to coordinate this better).

If you don’t look too closely, the declaration almost makes DOGE look smart. Except I decided to look at one of the reports — the second one — more closely.

And once I did, I realized that Thomas Krause is, in part, using Trump’s management failures during COVID as an excuse to start shutting down government. Start with the fact that the first agency Krause focused on after arriving at Treasury was USAID — pursuing his goal of making Treasury, “more responsive to the policy goals of this Administration.” But that’s not one of the high risk agencies, all of which have to do with direct payments.

Since 2003, which is when they first tracked the data, the amount of improper payments has steadily increased. But it has declined in recent years, under Biden.

There’s a reason for that. Look more closely at the estimated improper payments, their sources, and their timing. 

For longstanding programs — Medicare and Social Security, the ones Krause mentions in his declaration — the number of improper payments in recent years is about what it was under Trump. What has spiked in recent years (and then receded) are programs that expanded under COVID: Expanded Medicaid and unemployment access, and the PPP program rolled out under Trump, something Krause neglects to mention at [1]. A key thing this report measures is COVID mispayments — that is, improper payments made under programs set up under President Donald Trump, 1.0.

The quotes at [2] and [3] are not actually from the report. They’re from this website (which links to this report).

Many of the recommendations and data used in this report pertain to COVID or lessons learned from it. For example, the report recommends making the payment tracking center set up in response to COVID permanent.

Establish a permanent analytics center of excellence to aid the oversight community in identifying improper payments and fraud.28 This could be achieved by building upon and expanding PACE and making it permanent.

And it recommended building in such collection in case of any future emergency response — in part, to avoid the two to three year delay in finding these payments reflected in the table above.

Require OMB to (1) provide guidance for agencies to proactively develop internal control plans that would be ready for use in, or adaptation for, future emergencies or crises and (2) require agencies to report these plans to OMB and Congress.

Amend PIIA. Quickly reporting improper payment estimates for emergency relief programs is critical for agency accountability and transparency over whether appropriated funds were spent for their intended purposes. In addition, estimating improper payments and identifying root causes help ensure that agencies develop and implement corrective actions to reduce them.

In November 2020, we recommended that Congress consider, in any future legislation appropriating COVID-19 relief funds, designating all executive agency programs and activities that made more than $100 million in payments from COVID-19 relief funds as “susceptible to significant improper payments.31 Such a designation would require, among other things, agencies to report improper payment estimates for such a program and develop corrective actions to reduce improper payments. In March 2022, we recommended that Congress amend PIIA to apply this criterion to all new federal programs for their initial years of operation.32 The current approach resulted in 2-to-3 year delays in reporting improper payment estimates for short-term and emergency spending COVID relief programs.

Much of the fraud, too, pertains to COVID relief.

When it is discovered, the Department of Justice (DOJ) can bring charges of fraud against the alleged fraudsters. For example, DOJ has prosecuted over 2,000 COVID-19 fraud-related cases, and hundreds of additional cases are pending. We analyzed the department’s public statements and court documentation and found that, from March 2020 through March 2024, at least 1,998 individuals or entities facing fraud-related charges were found guilty or liable.16 This includes charges in cases involving SBA’s loan programs, DOL’s Unemployment Insurance (UI) programs, and Treasury’s economic impact payments. Of the individuals found guilty, at least 1,596 had been sentenced as of March 31, 2024, and many have also been ordered to pay restitution and fines. There were also federal fraud-related charges pending against at least 632 other individuals or entities involving federal COVID-19 relief programs, as of March 31, 2024.17 We expect the number to continue to increase as investigations take time to develop and given the significant number of investigative leads. For instance, SBA’s IG office reported that its actionable leads represent more than 100 years of investigative case work.18 The government has 10 years to prosecute individuals who committed fraud related to the Paycheck Protection Program (PPP) and the COVID-19 Economic Injury Disaster Loan (EIDL) program.19 DOL’s IG has requested Congress similarly extend the statute of limitations for the pandemic relief UI programs as well.20 Additionally, in a June 2024 press release, the Internal Revenue Service requested to Congress that the statute of limitations for fraud be extended for the Employee Retention Credit.21 We support their requests.

Now, to be fair, there was likely to be overpayments and fraud regardless of who was in charge when COVID hit (or when avian flu and measles become pandemics in months ahead).

This is not all attributable to Trump’s COVID failures.

But one other thing about this report deserves mention: It is full of discussion of the role of Inspectors General in finding this fraud, including a bunch of the people Trump fired four days into his term — six of whom just filed suit today (which I’ll turn to shortly). Indeed, one of them — Mike Ware — is cited in the report Krause invoked.

18 Stolen Taxpayer Funds: Reviewing the SBA and OIG Reports of Fraud in Pandemic Lending Programs Hearing Before the House Committee on Small Business, 118th Cong. 45 (2023) (statement of Hannibal “Mike” Ware, Inspector General of U.S. Small Business Administration).

Thomas Krause says we need to fix the errors created by Trump’s poor management of COVID. But one of the first things Trump in his second term did was to fire the people who’ve done the most to do so.

Update: Corrected Mike Ware’s last name.

Update: I’ve linked Ware’s testimony, above. Among other things, he estimated that SBC IG identified up to $200 billion in fraudulent COVID relief.

Using OIG’s investigative casework, prior OIG reporting, advanced data analytics, and additional review procedures, we estimate SBA disbursed more than $200 billion in potentially fraudulent COVID-19 EIDLs and PPP loans. This estimate represents approximately 17 percent of disbursed COVID-19 EIDLs and PPP funds — specifically, more than $136 billion COVID-19 EIDLs and $64 billion in PPP funds. Since SBA did not have an established strong internal control environment for approving and disbursing program funds, there was an insufficient barrier against fraudsters accessing funds that should have been available for eligible business owners adversely affected by the pandemic.

In other words, a huge chunk of the fraud Krause says he is looking for was IDed by one of the guys Trump fired on day four.

According to the currently operative story, Marko Elez — the DOGE [sic] boy who had source code for Treasury’s payments system — resigned in response to a query from WSJ reporter Katherine Long about his social media posts in support of

A key DOGE staff member who gained access to the Treasury Department’s central-payments system resigned Thursday after he was linked to a deleted social-media account that advocated racism and eugenics.

Marko Elez, a 25-year-old who is part of a cadre of Elon Musk lieutenants deployed by the Department of Government Efficiency to scrutinize federal spending, resigned after The Wall Street Journal asked the White House about his connection to the account.

“Just for the record, I was racist before it was cool,” the account posted in July, according to the Journal’s review of archived posts.

“You could not pay me to marry outside of my ethnicity,” the account wrote on X in September. “Normalize Indian hate,” the account wrote the same month, in reference to a post noting the prevalence of people from India in Silicon Valley.

After the Journal inquired about the account, White House spokesperson Karoline Leavitt said that Elez had resigned from his role.

But that belief is only based on correlation, not any proof of causation. Long asked about posts that are in no way exceptional for the far right boys Elon has infiltrated into the government. And Elez resigned that same day.

Sure, Elon implied that Elez quit because the boy’s far right ideology was exposed — he led a campaign for his reinstatement. That campaign — and JD Vance’s support for it — similarly led a lot of people to believe that Elez had been reinstalled at Treasury. But multiple court filings claim that Elez resigned and never came back, at least not to Treasury.

In fact, there are two things that might provide better explanations than the discovery that like Elon himself, Elez is a racist.

As WSJ itself notes, Elez resigned the same day that Colleen Kollar-Kotelly ordered that Elez, then still identified as a Special Government Employee, be granted only read-only access to Treasury’s networks. Once Elez no longer worked for the defendants in that case — starting with Scott Bessent — then any access he had would be exempted from the order.

More importantly, as a court filing submitted yesterday reveals, Elez’ resignation happened the same day that Treasury discovered Elez’s Bureau laptop, “had mistakenly been configured with read/write permissions instead of read-only.” The filing is a declaration from Joseph Gioeli, who has been employed as the “Deputy Commissioner for Transformation and Modernization in the Bureau of the Fiscal Service” since 2023 and is a civil servant first hired in the first year of Trump’s first term.

His declaration describes how the 4-6 week “payment process engagement plan” initiated (per Thomas Krause) on January 26 required giving Elez risky access to payment systems. Gioeli describes how they tried to mitigate those risks.

11. The scope of work as envisioned in the engagement plan required access to Fiscal Service source code, applications, and databases across all these Fiscal Service payment and accounting systems and their hosting environments. This broad access presented risks, which included potential operational disruptions to Fiscal Service’s payment systems, access to sensitive data elements, insider threat risk, and other risks that are inherent to any user access to sensitive IT systems. In light of these risks, BFS and Treasury Departmental Office employees developed mitigation strategies that sought to reduce these risks.

12. These measures included the requirement that Mr. Elez be provided with a BFS laptop, which would be his only method of connecting to the Treasury payments systems, both in connecting with the source code repository and for his read-only access of the systems. He had previously been provided a Treasury laptop from the Department shortly after he onboarded, but due to Bureau security policy, that device was restricted from accessing the BFS systems and services he had requested. BFS used several cybersecurity tools to monitor Mr. Elez’s usage of his BFS laptop at all times and continuously log his activity. Additionally, the Bureau enabled enhanced monitoring on his laptop, which included the ability to monitor and block website access, block the use of external peripherals (such as USB drives or mass storage devices), monitor any scripts or commands executed on the device, and block access to cloud-based storage services. Additionally, the device contained data exfiltration detection, which alerts the Bureau to attempts to transmit sensitive data types. The laptop is also encrypted in accordance with Bureau policy, which, if the laptop were stolen or lost, would prevent unauthorized users from accessing data contained within the laptop.

13. Additional mitigation measures that were adopted included that Mr. Elez would receive “read-only” access to the systems, and that any reviews conducted using the “read-only” access would occur during low-utilization time periods, to minimize the possibility of operational disruptions. While providing a single individual with access to multiple systems and data records accessed here was broader in scope than what has occurred in the past, this read-only approach is similar to the kind of limited access the Bureau has provided to auditors for other Treasury non-payment systems, though even in those scenarios the availability of production data was significantly limited. [my emphasis]

Gioeli goes on to describe how, starting on February January 28, the Bureau gave Elez source code in a sandbox environment.

16. On January 28, 2025, the Bureau provided Mr. Elez with the Bureau laptop and with copies of the source code for PAM, SPS, and ASAP in a separate, secure coding environment known as a “secure code repository” or “sandbox.” Mr. Elez could review and make changes locally to copies of the source code in the cordoned-off code repository; however, he did not have the authority or capability to publish any code changes to the production system or underlying test environments. This repository was separate from Fiscal Service’s typical code development environment, and unlike the usual code development environment, this new repository was segmented, to ensure that no changes to the operative source code could be made. [my emphasis]

Then, six days after giving him that sandbox access, using the same laptop, they gave him read-only access to first two and then one more systems.

17. On February 3, 2025, consistent with the engagement plan and mitigation measures developed, Mr. Elez was provided with read-only access, through his Bureau laptop, to the certain BFS systems. The read-only access that Mr. Elez was provided gives the user the ability to view and query information and data but does not allow for any changes to that information and data within its source system. While this reduces risk, it does not fully eliminate the risks identified in the assessment (for example, the risk of overburdening the system with a complex read-only query). Specifically, Mr. Elez was provided read-only access to the Payment Automation Manager (PAM) Database, Payment Automation Manager (PAM) File System, and, subsequently on February 5, the Secure Payment System (SPS) Database.

After he got that access, per a review of the logs, Elez copied some files from the active database onto his Bureau laptop, on which he had the source code.

18. ISS configured his network access and assisted him in setting up the necessary tools to connect to the PAM database on February 3. His access was closely monitored by multiple BFS administrators throughout the process on February 3. That same day, he received a “walk-through” demonstration of two BFS payment systems, the PAM database and the PAM file system (the system that controls the payment file “landing zone” discussed above), to see how the systems worked. He logged in with his read-only access to these systems on February 3 during this “walk-through” demonstration. The Bureau is in the process of reviewing the logs of Mr. Elez’s activity on his Bureau laptop, and this review remains ongoing. Based on the preliminary log reviews conducted to date, it appears that on February 3, Mr. Elez copied two USAID files directly from the PAM database to his BFS laptop; on February 4 and 5, Mr. Elez accessed the PAM file system; and on February 5, Mr. Elez accessed the PAM payment processing database. These activities are consistent with the read-only access that Mr. Elez was provided and did not change or alter any BFS payment system or record within their source systems. As noted, reviews of Mr. Elez’s work are still actively occurring; I do not have any more detail to provide at this time about his activities with respect to PAM. [my emphasis]

Then, on February 5, Elez got access to the payment system itself — again, with the same laptop on which he had source code.

19. Due to scheduling constraints, Mr. Elez was unable to meet with Bureau personnel to set up his access to the SPS database until February 5. On that date, lSS held a virtual walk-through session to help him to connect to the SPS database. He accessed this database exclusively under the supervision of Bureau database administrators in a virtual walkthrough session. According to the preliminary review of logs the Bureau has conducted to date, it appears Mr. Elez accessed the SPS database only once during that walk-through demonstration on February 5. It does not appear that he accessed the database again. As part of the ongoing review, additional log reviews are currently underway to confirm this. Mr. Elez never logged into ASAP, CARS, or ITS.gov, as technical access to those systems was never established for him. [my emphasis]

The next day, “it was discovered” (Gioeli does not say by whom, which means we’re not seeing a declaration from that person) that Elez actually “had mistakenly been configured” with read/write access, rather than “read only.”

20. On the morning of February 6, it was discovered that Mr. Elez’s database access to SPS on February 5 had mistakenly been configured with read/write permissions instead of read-only. A forensic investigation was immediately initiated by database administrators to review all activities performed on that server and database. The initial investigation confirmed that all of Mr. Elez’s interactions with the SPS system occurred within the supervised, walk-through session and that no unauthorized actions had taken place. His access was promptly corrected to read-only, and he did not log into the system again after his initial virtual over-the-shoulder session on February 5. To the best of our knowledge, Mr. Elez never knew of the fact that he briefly had read/write permissions for the SPS database, and never took any action to exercise the “write” privileges in order to modify anything within the SPS database—indeed, he never logged in during the time that he had read/write privileges, other than during the virtual walk-through – and forensic analysis is currently underway to confirm this. [my emphasis]

Throughout his declaration, Gioeli stresses that they’re still investigating whether Elez did something unauthorized with his access.

21. As noted above, the Bureau used several cybersecurity tools to monitor Mr. Elez’s usage and continuously log his activity. While forensic analysis is still ongoing, Bureau personnel have conducted preliminary reviews of logs of his activity both on his laptop and within the systems and at this time have found no indication of any unauthorized use, of any use outside the scope that was directed by Treasury leadership, or that Mr. Elez used his BFS laptop to share any BFS payment systems data outside the U.S. Government.

And his declaration stops short of saying that some mitigation techniques were used. For example, Gioeli says that the enhanced monitoring on Elez’ Bureau laptop had the ability to “block the use of external peripherals (such as USB drives or mass storage devices)” and access to the cloud, but it doesn’t say whether those functionalities was used.

Plus, Gioeli’s declaration makes it clear that they have’t involved Elez in any review of his access. No one has asked Elez, for example, whether he knew he had write access to the payment system.

Similarly, in an earlier declaration submitted in the parallel DC case, Thomas Krause gave a very couched answer about whether Elez had has any ongoing access.

I currently have no reason to believe Mr. Elez retains access to any BFS payment data, source code, or systems.”

Did anyone think to ask the guy? Does anyone know where that guy is? Are you going to interview him? Or is someone deliberately trying to keep him from being questioned further?

Worse still, Thomas Krause declaration submitted in the NY case doesn’t even say that Elez has left Treasury — only that he has resigned from the role of, “working closely with engineers at the Bureau of the Fiscal Service (BFS) on information technology (IT) matters in service of BFS’s mission to promote financial integrity and operational efficiency of the federal government through accounting, financing, collection, payment, and other relevant BFS services.”

On February 6, 2025, Mr. Elez submitted his resignation from this role. On that same day, he turned in his Treasury laptop, BFS laptop, access card, and other government devices; his BFS systems access was terminated; and he has not conducted any work related to the BFS payment systems since that date.

Elez was made a Treasury employee — contrary to early reports, he was not a SGE. That may make it easier to shuffle him off somewhere else.

What Gioeli describes is the panic that ensues when a guy who had high level access quits unexpectedly. And to date, we’ve never been given a formal explanation of why he quit — or whether he was asked to do so. We certainly can’t reconcile the claims that he has been reinstated with claims that he’s not doing what he was doing at Treasury.

Everyone has always assumed that Elez quit because his racism was discovered. But given the timeline, we can’t rule out that he quit because of the access concerns (and ongoing investigation) at Treasury.

Timeline

January 21: Elez hired.

January 23: Krause hired.

January 26: Treasury focuses on USAD. Treasury also adopts a 4-6 week engagement plan.

January 28: Bureau provides Elez with Bureau laptop copies of the source code for PAM, SPS, and ASAP in sandbox.

January 31: Treasury focuses on TAS codes; Elez assists in “automating” manual review of payments. “A high-ranking career official at Treasury also raised the issue of risks from DOGE access in a memo to Treasury Secretary Scott Bessent.”

February 3: Treasury gives Elez access to PAM. Booz threat contractor delivers report warning of grave insider threat.

February 5: Treasury gives Elez access to SPS, the payment system.

February 6 (afternoon): Elez resignation.

February 7: Treasury flags but then approves four payments. WaPo publishes story about Booz report and Booz contractor is fired.

February 8: Paul Engelmeyer limits Krause’s access.

February 10: Millenium Challenge Corporation submits, but then requests not to process, a payment.

Documents

Opposition to Stay

Thomas Krause Declaration: Describing the plan to use technology to provide more oversight over payments (citing three Biden-era GAO reports, not anything DOGE has discovered).

Vona Robinson Declaration: Describing that the only payment that has been intercepted at Treasury was a payment to the Millenium Challenge Corporation.

Michael Wenzler Declaration: Describing the hiring, employment status, revisions thereof, of Thomas Krause and Marko Elez, and also confirming Elez’ resignation from Treasury.

Joseph Gioeli Declaration: Describing the circumstances of Elez’ access and the investigation into what he did with it.

At a weird appearance in the Oval Office rife with awkward projections that Elon Musk believes he is more powerful than Trump (here’s the full CSPAN video), a journalist asked Elon how — given the egregious error he made about condoms and Gaza — we should believe anything he said.

The exchange is bad enough: Elon basically confessed, in front of Trump, that a hoax Elon started that traveled first to Trump propagandist Karoline Leavitt and from there, through Jesse Watters’ exaggerations on Fox News, into several repetitions of the false claim by Trump was wrong.

The entire point of this presser was to substantiate Trump’s false (and undocumented) claim that DOGE [sic] had found billions of dollars of waste, fraud, and abuse and use that to, first, pressure judges who are putting brakes on DOGE and, then, justify giving DOGE [sic] authority to fire a bunch of people via Executive Order.

When Trump asked Elon to substantiate such claims, Elon instead vaguely pointed to people who were wealthy even though they had meager salaries — not something that should be under his review. He listed other things that are known — and were known, during Trump’s first term — which are archaic but not fraud.

And in that appearance, a journalist called Elon out for inventing something about Gaza that led Trump to lie publicly.

That should have led to stories about how, in Trump’s presence, Elon admitted he makes shit up and Trump repeats them.

For the most part, it didn’t happen:

• NYT noted that Elon offered no proof of fraud, but did not mention the proof that Elon got caught in a lie.
• WaPo focused on the EO, but later explained that neither Trump nor Musk offered proof — but didn’t mention he got caught in a lie.
• Politico focused on the EO, but later noted that Elon said he would police his own conflicts.
• In an analytical piece, CNN claimed that Elon offered examples of fraud (which is false), but didn’t mention Gaza.

After airing Elon about scrutiny he claimed he was getting, WSJ did mention the Gaza question.

Asked about the Trump administration’s false assertion that the federal government sent $50 million worth of condoms to Gaza, the billionaire acknowledged that he might at times promote erroneous information. “Some of the things that I say will be incorrect and should be corrected,” Musk said. “Nobody is going to bat 1,000.”

But WSJ didn’t pursue the implication of it: that Elon got caught in a false claim.

Indeed, the only specific example that Trump mentioned was funding FEMA spent in NYC to house migrants — something approved by Congress — for which the staffers have been fired (as I’ll return to, Trump’s DOJ is already misrepresenting this in courts), was also based on an Elon lie.

The Trump administration said on Tuesday that it had fired four employees from the Federal Emergency Management Agency, including the agency’s chief financial officer, over their roles in disbursing federal funds to house migrants in New York City hotels.

The firings capped a startling chain of events that began on Monday with an early-morning social media post by Elon Musk who claimed, misleadingly, that FEMA had recently sent $59 million meant for disaster relief to New York City to pay for “high end hotels” for migrants, and who called the expenditure unlawful.

New York City officials raced to clarify that the federal money had been properly allocated by FEMA under President Joseph R. Biden Jr. last year, adding that it was not a disaster relief grant and had not been spent on luxury hotels.

Nonetheless, just two hours after Mr. Musk’s post, FEMA’s acting director, Cameron Hamilton, announced that the payments in question “have all been suspended” — even though most of the money had already been disbursed — and that “personnel will be held accountable.”

By Tuesday morning, roughly 24 hours after Mr. Musk’s post, the Trump administration had followed through on one part of its pledge.

Elon also made a false claim that they had turned on AIDS prevention — in one of the state lawsuits, Washington State presented a case where funds for AIDS prevention programs was being withheld.

This press conference consisted of Elon (and Trump) making false claim after false claim.

It also consisted of Trump lying over and over, without proof, about how one only needed to look for fraud to find it. No one asked why he hadn’t looked in his first term. Indeed, several times he blamed Biden for problems that have existed for decades.

And yet, at best, journalists instead claimed only that Elon and Trump simply presented no proof.

Yesterday, I argued that Trump would not yet defy courts because he wants to invite the Supreme Court to sanction his dictatorial powers, and so wants a clear appellate record.

Boy howdy was that a short-lived theory. Trump says he is appealing two orders that are not yet ripe for appeal in two lawsuits involving Democratic Attorneys General — RI Judge John McConnell’s order and follow-up order that the government pay grants to the states [appeal] and Paul Engelmeyer’s order ordering Treasury to stay out of the payment system [request for stay pending appeal] — as well as in Special Counsel Hampton Dellinger’s challenge to his dismissal.

So by the time Republicans figure out how they’re going to use reconciliation to pass Trump’s policies, SCOTUS may have already agreed to gut Congress’ power of the purse.

But the record in the spending cases is anything but clean.

In one of the two cases challenging DOGE’s [sic] access to Treasury systems — the DC case before Colleen Kollar-Kotelly — DOJ decided after the fact that Marko Elez, the DOGE [sic] boy who had been granted a copy of Treasury systems to sandbox, was actually a Treasury employee.

With the benefit of more time to investigate the facts over the weekend, Defendants came to understand that Marko Elez, who, at the time of the hearing was employed by the Department of the Treasury, had not, in fact, been designated by the Treasury Department as a Special Government Employee (SGE), as counsel stated at the February 5 hearing. Mr. Elez, was, however, a Treasury Department employee. Treasury hired Mr. Elez as Special Advisor for Information Technology and Modernization, Departmental Offices, Office of the Chief of Staff, under Treasury’s authority to establish temporary transitional Schedule C positions. See 5 C.F.R. § 213.3302. Although Mr. Elez could have been designated as an SGE because he was slated to perform temporary duties either on a full-time or intermittent basis for not more than 130 days, the Treasury department Ethics office did not designate Mr. Elez as a Special Government Employee, meaning that he in fact had to comply with additional ethics requirements that are not required for SGE positions.

[snip]

Defendants also wish to notify the Court that, as stated in the Declaration of Thomas Krause, Jr., filed yesterday, in State of New York v. U.S. Department of the Treasury, Case No. 25 Civ. 01144 (JAV) (S.D.N.Y.), Mr. Elez resigned from Treasury on February 6, 2025, and he returned all Treasury and BFS equipment and credentials the same day. See Exhibit 1, ¶ 11. Moreover, in that case, on February 8, the Court entered a temporary restraining order restricting who may access Treasury systems. See Ex. 2. Those restrictions are in addition to those imposed by this Court’s Order entered February 6.

This filing included Thomas Krause’ declaration (submitted in the Treasury suit filed by states, which Trump is appealing) describing that Elez had resigned (but not addressing whether he has been reinstated; in retrospect, it seems the declaration was written specifically to avoid calling Elez a DGE). But it didn’t include the underlying filing in the case, which in a footnote confesses that Elez had a full copy of the BFS system in a sandbox, falsely claiming that Krause addressed this in his declaration.

2 Since January 20, 2025, one other Treasury employee—Marco Elez—had “read only” access to or copies of certain data in BFS payment systems, subject to restrictions, and access to a copy of certain BFS payments systems’ source code in a “sandbox” environment. Krause Decl. ¶ 11. Mr. Elez resigned on February 6, 2025 and returned all Treasury and BFS equipment and credentials the same day. Id

This means that this correction doesn’t correct another false claim DOJ made to Kollar-Kotelly: that Elez’ access had been “read only.” And DOJ hasn’t told Judge Jeanette Vargas (to whom the New York case was assigned after Engelmeyer issued the TRO) that Elez is a full Treasury employee and so, if he has been reinstated, potentially excluded from Engelmeyer’s order.

In the USAID case, where Trump might believe he can coax a favorable ruling from his own first term appointee, Carl Nichols, Peter Marocco submitted a long, obnoxious declaration claiming they had to shut down USAID because of widespread insubordination among USAID employees. (I’d quote from it but the declaration breaks local rules requiring OCR filings.)

But after Marocco submitted that filing, the career AUSAs on the case submitted a declaration that included this correction.

Additionally, although Secretary Rubio’s January 24, 2025 directive only froze future contract obligations, id. ¶ 3, payments on existing contracts were paused as well as part of efforts by agency leadership to regain control of the organization’s spending and conduct a comprehensive review of its programs. See id. ¶¶ 5–10. Counsel for Defendants was unaware of this development prior to the hearing. [my emphasis]

Marocco confesses that existing contracts “were paused” by him this way:

Furthermore, many of USAID’s pre-existing programs were in conflict with the directives and priorities of the President and Secretary, and therefore were inconsistent with the public interest and foreign policy judgments of the Executive Branch. Given the scale of these programs, an ad hoc review of these conflicting programs would unduly burden the execution of the President’s other foreign policy priorities. A blanket pause with a waive-in process was the more efficient and effective path.

He describes this notice Marco Rubio sent to Congress, which makes no mention of pausing ongoing work. Then he continues to describe how existing programs “were paused” by him.

The first step of this review, in essence, involved the majority of USAID pausing a substantial portion of its ongoing work — going “pencils down” — so the Secretary and USAID leadership could gain control of the organization that included some employees who had refused to comply with lawful directives by the President and Secretary, directives designed to identify wasteful or fraudulent programs or those contrary to the foreign policy interests of the United States. The pause of ongoing work and use of paid administrative leave have enabled Agency leadership to begin a thorough review of USAID’s operations and align its functions to the President’s and Secretary’s priorities, without continued noncompliance by former Agency leadership and management undermining those priorities. Pausing a majority of USAID’s work was, and remains, necessary to continue this thorough review into the noncompliance issues first identified, as well as to continue to examine USAID’s processes and the manner in which USAID funds its programs.

In other words, the people that Marocco calls noncompliant are noncompliant because they’re following the law, a law uncontroverted by Trump’s order or even Rubio’s notice to Congress.

As Nichols said when he issued the TRO ordering USAID to reinstate employees, whether or not this involved existing or only prospective contracts was an issue of some contention in the hearing.

Plaintiffs finally seek a TRO as to Secretary Rubio’s January 24, 2025 order freezing funding to USAID’s contractors. As a threshold matter, the Court notes that there are significant factual questions about what the practical effect of that order is. The government argued at the hearing that the order only prevents USAID from entering “new obligations of funding”—leaving it free to pay out contracts that it entered into prior to January 24, 2025—and indeed, the text of the order does seem to permit that result. Dep’t of State, Memo. 25 STATE 6828. Yet, plaintiffs maintained at the TRO hearing that payments on existing USAID grants have been frozen, preventing certain “contracting officers” employed by USAID from using agency funds to fulfill monetary commitments that the agency had already made.

This factual dispute is relevant to plaintiffs’ TRO arguments, but ultimately is not dispositive of them. Plaintiffs allege that, by some legal mechanism, USAID contracting officers can be held personally liable for existing contractual expenses that USAID is supposed to, but does not, pay. Plaintiffs thus argue that those officers face irreparable harm as a result of the funding freeze because they will be left “holding the bag” when USAID imminently fails to disburse funds. Separately, plaintiffs argue that the general population of USAID employees will be emotionally harmed by the agency’s inability to pay its contractors because they will be stuck “watching a slow speed train wreck” as the agency reneges on its humanitarian commitments.

Even assuming the funding freeze indeed prevents payments on existing grants in the way plaintiffs claim (instead of merely preventing USAID from entering new obligations, as the government suggested during the hearing), the Court concludes that plaintiffs have not demonstrated resulting irreparable harm.

But because this suit involves employees, rather than states or other recipients of funds from Treasury (as is the case in the two suits where DOJ has said it will appeal), these plaintiffs themselves are not being injured because they’re still being paid.

DOJ is hiding behind career AUSAs making claims they likely do not know are false so as to shut down appropriations that have already been approved.

And they are appealing each instance in which a plaintiff has genuinely been injured (the states and Hampton Dellinger’s firing) in hopes — or maybe expectation? — after the Circuits deny appeals that are not yet ripe, SCOTUS will step in and render Congress impotent.

Update: USAID Inspector General somehow managed to put together a report on the damage the chaos is having. Among other things, it finds that the cuts have incapacitated any means of vetting disbursements to keep them out of the hands of terrorists.

USAID describes partner vetting as a risk-mitigation tool to “ensure that American taxpayer funds do not benefit terrorists and their supporters.” Currently, partner vetting is required for programming in Afghanistan, Iraq, Lebanon, Pakistan, Syria, West Bank/Gaza, and Yemen where designated terrorist organizations such as Hamas, Hezbollah, ISIS, and Ansar Allah (also known as the Houthis) operate. Before the Agency awards a contract, grant, or cooperative agreement in these locations, the proposed awardee must submit to USAID data needed to vet the organization and its key personnel. The same vetting must be undertaken before an aid organization issues a subaward. While USAID OIG has previously identified gaps in the scope of partner vetting, 10 USAID staff have reported that the counter-terrorism vetting unit supporting humanitarian assistance programming has in recent days been told not to report to work (because staff have been furloughed or placed on administrative leave) and thus cannot conduct any partner vetting. This gap leaves USAID susceptible to inadvertently funding entities or salaries of individuals associated with U.S.-designated terrorist organizations.

For some time, we’ve all been assuming that Trump will defy court orders reining in his assault on the government. And then, in the wake of Judge Paul Engelmayer’s order enjoining Scott Bessent from altering Treasury’s payment system before Friday, JD Vance ran his mouth, convincing everyone that that moment is already here.

Overnight, filings in at least two of the lawsuits against Trump’s attacks suggests that Trump is, at least for now, complying.

• In the Rhode Island case in which states enjoined OMB from withholding government grants the government filed a response describing, among other things, how they’ve worked to ensure payments to Oregon continue.
• In the New York lawsuit, also brought by states, DOJ asked for clarification of the scope of Engelmeyer’s order and opposed the breadth of it (noting, that there were contractors who did work on the system and also listing some senior Treasury officials, political appointees, who needed access). With that, Thomas Krause submitted a declaration saying he’s the only Special Government Employee who currently has permission to access the system (meaning they’re also complying with Colleen Kollar-Kotelly’s order in DC), but also revealing that Marko Elez — the DOGE boy who was included in Kollar-Kotelly’s order — has not returned to Treasury. Krause even notes (as I did) that the order to destroy what Elez has done likely conflicts with the order Kollar-Kotelly issued.

DOJ is pushing at the terms of the orders limiting government actions. But it at least claims it is complying.

There is other conflicting evidence about implementation. I have also seen reports that USAID people stationed overseas were having their access to communications systems restored, in compliance with Carl Nicoles’ order. But WaPo reports that the Administration continues to process resignations in potential defiance of George O’Toole’s order halting the Fork in the Road program.

I don’t doubt that at some point Trump will defy the courts. But for a number of reasons, I suspect they won’t outright defy judges yet.

One main reason is obvious: Trump and Russ Vought want John Roberts to grant him the authority to — basically — neutralize Congress’ power of the purse. To do that, he needs a clean appellate record. So he has to go through the process of engaging in good faith (even while arguing, as he did in his response to the Engelmeyer order, for a maximal theory of Executive power).

Another reason likely has to do with Pam Bondi. She has her own malign goals for DOJ, such as a likely assault on medical abortion pills, both between and within states. Plus, she is pursuing Trump’s attacks on sanctuary states.

But to use DOJ for these policy purposes, there has to be a DOJ, with attorneys more competent and experienced in Federal litigation than Ed Martin, the Acting US Attorney in DC. With the possible exception of the birthright citizenship defense, DOJ has real AUSAs fighting these cases, AUSAs who are going to be unwilling to risk their bar license on frivolous legal arguments or lies.

Finally, I think DOJ is in a risky situation in its confrontation with attorneys and FBI personnel. Ben Wittes noted recently, the Administration needs the FBI, in ways it doesn’t need USAID personnel, at least not in the same potentially catastrophically visible way they need the FBI.

The FBI rank and file have power in this equation that other agencies, such as USAID, for example, do not have. The Trump administration does not need USAID. It wants to eliminate foreign aid anyway, so if the personnel at the aid agency get uppity, who cares? And if they quit? All the better.

The FBI is not that simple. For one thing, the administration does need law enforcement. If there’s a terrorist attack, and there will be, and the FBI is not in a position to prevent it or investigate it quickly and effectively, the administration will take the blame.

This administration also draws its legitimacy from backing the blue. Even in their war on the intelligence community, Donald Trump and his people always tried to distinguish between the rank and file and the “bad apples” who were running things. Waging a full-scale war against the nation’s premier law enforcement agency, a war that is all about targeting street agents for having done their jobs, is a dangerous game—far different from sacking an FBI director, or even two, who went to some elite law schools and served at the upper levels of the Justice Department.

Then there’s the problem of capacity. FBI agents are actually very hard to replace—good ones are, anyway. The physical demands are significant. Most have specialized education of one sort or another. And while people often imagine FBI agents as glorified cops who kick doors down, the truth is that a lot of agents have exquisitely specialized expertise. The training of a good counterintelligence agent takes many years. Some agents have specialized scientific training. There are even agents who specialize in art theft. Take out a thousand FBI personnel for political reasons, and you destroy literally centuries of institutional capacity. A good FBI agent is much harder to create than, say, a good assistant U.S. attorney.

The confrontation with FBI has allowed accidental hero, Brian Driscoll (who is only serving as Acting Director as opposed to Acting Deputy Director because the White House made an error), has played this well, including by raising his own profile and the successes of the FBI.

That hasn’t stopped DOJ from demanding loyalty pledges, in the form of treating the mob that violently attacked cops and the Capitol as more patriotic than the cops themselves or the Members of Congress who did their duty — effectively (though WaPo doesn’t make this clear) forcing FBI agents to disavow treating a violent attack as a crime. But that, in turn, risks real backlash.

To be sure, there’s a lot of garbage that’s being dealt here. DOJ told Colleen Kollar-Kotelly that DOGE at that point only had read-only access to Treasury data (which Anna Bower recognized as an attempt to parse). But a footnote in the overnight filing in New York confesses that’s false.

Since January 20, 2025, one other Treasury employee—Marco Elez—had “read only” access to or copies of certain data in BFS payment systems, subject to restrictions, and access to a copy of certain BFS payments systems’ source code in a “sandbox” environment. Krause Decl. ¶ 11. Mr. Elez resigned on February 6, 2025 and returned all Treasury and BFS equipment and credentials the same day. Id.

That footnote cites Krause’s declaration. But the bit about the sandbox copy is not in the cited paragraph.

Since January 20, 2025, one other Treasury non-career employee—Marko Elez—had access to BFS payment systems and payment data covered by the order. Mr. Elez resigned on February 6, 2025, and returned all Treasury and BFS equipment and credentials the same day. Treasury staff have quarantined and disabled access to all devices and accounts used by this individual, which can now only be accessed by civil servants with a need for access to perform their job duties within the BFS who have passed all background checks and security clearances and taken all information security training called for in federal statutes and Treasury Department regulations. Further, based on technical controls in place, BFS oversight of Mr. Elez’s work, instructions provided to Mr. Elez regarding proper data handling, and subsequent technical review of his activities, I currently have no reason to believe Mr. Elez retains access to any BFS payment data, source code, or systems. I am concerned that deleting the contents of these accounts and devices would violate Treasury’s document preservation duties in connection with related litigation entitled Alliance for Retired Americans, et al. v. Bessent, et al., Civil Action No. 25-0313 (CKK) (D.D.C.).

Similarly, an OPM suit may well prove that DOJ has misrepresented other claims to courts. And as the FBI lawsuits hung overnight, DOJ forced Driscoll to provide names of all the FBI Agents who worked on January 6 cases.

But these discrepancies may well be useful. At the very least, it provides cause for the AGs to insist that Krause appear before Judge Jeannette Vargas, the judge assigned to the case (who ordered the parties to try to clarify Saturday’s order) to explain what Elez was doing with his sandbox and why anyone should believe he hasn’t been rehired, somewhere, to play in his sandbox some more. That, in turn, would support the very cybersecurity arguments that various lawyers are trying to make. And it’ll advance the reporting already going on.

JD Vance might well like to simply ignore Engelmeyer’s order. Mike Davis might want Trump to appeal this immediately to SCOTUS. Trump might want to start siccing his mob on judges.

But there are good reasons to believe that that won’t happen, yet — at least not until Trump gets a few more of his national security and DOJ nominees through the Senate.

And until then, this legal process is a tool — a tool that can be used to buy time, but also a tool to use to hem in Trump’s mob.

Update: In RI, John McConnell issued what is likely the first, “no really, you have to follow my orders” order.

Update: DOJ has appealed McConnell’s order, even though it is not ripe.

Meanwhile DOJ has filed really long filings in DC in an attempt to persuade Carl Nichols to reverse his TRO in the USAID example, basically slandering unnamed professionals left and right. Things do look more dire, because Trump is basically refusing to fund blue states until SCOTUS tells him to–and maybe even not then. Meanwhile, Senate Republicans have simply capitulated to Trump’s insane nominees.

Update: Above I noted that DOJ needs career AUSAs to make these arguments, at least for a while.

Well, in the USAID case, those career AUSAs just had to cop to two, um, errors. The bigger one was the central dispute at the hearing last week: Whether USAID had only frozen prospective contracts, or all of them

Additionally, although Secretary Rubio’s January 24, 2025 directive only froze future contract obligations, id. ¶ 3, payments on existing contracts were paused as well as part of efforts by agency leadership to regain control of the organization’s spending and conduct a comprehensive review of its programs. See id. ¶¶ 5–10. Counsel for Defendants was unaware of this development prior to the hearing. [my emphasis]

This implies that Peter Marocco froze existing contracts without the authority of Marco Rubio. And he’s accusing USAID personnel of being insubordinate.

Thus far, Trump’s biggest success on immigration in his second term has been to claim credit — twice! — for things that Sleepy Joe Biden did, in one case years ago.

He threatened sanctions on Colombia, only to agree to let Colombian President Gustavo Petro send planes to fetch deportees, sometimes in Colombian military planes, rather than receive them in US military planes.

He threatened sanctions on Mexico, only to boast after Claudia Sheinbaum committed to put 5,000 fewer Mexican troops on the border than are already there, the same 10,000 that Biden obtained years ago.

He threatened sanctions on Canada, only to boast that Justin Trudeau agreed to the same $1.3 billion in investments to counter fentanyl trafficking he put in place in December.

As for his efforts to round up and deport migrants in the US? Almost two weeks ago, I noted that the quotas ICE introduced to try to boost the deportation numbers fell wildly short of delivering the deportations Trump had promised his rubes, to say nothing of the way those quotas will lead to deportation of non-criminal migrants instead of the violent criminals Trump claims to be targeting. Almost two weeks ago, Trump’s flunkies confessed they would never be able to meet his promises for mass deportation.

The fate of a highly publicized raid in Aurora last week is a spectacular case in point.

On Thursday, shortly after the raid, the Fox News propagandist whose job it is to stoke fear about migration, Bill Melugin, first celebrated the “massive” raid, only later to reveal the raid had resulted in far fewer arrests than promised and just one arrest of a Tren de Aragua member. ICE immediately blamed its failure to detain more people on leaks.

That same day, Tom Homan announced he may have to halt the kind of embed ICE has been all too happy to give Melugin, because of leaks or operational security; he did not say that truthful reports to Fox viewers about his failures gets him in trouble with the boss. Tom Homan can’t afford to have Trump know that this massive raid found only a single Tren de Aragua member.

The raid focused on an apartment complex that had been the focus of a wildly propagandistic Trump campaign event headlined by Stephen Miller last year.

Both reporting sympathetic to migrants and that of mainstream outlets describes what actually happened, why the raid failed to lead to the number of arrests Trump promised: Heavily armed officers swarmed the building and knocked on every door, but after residents didn’t open up, they finally left. (Update: Elevating this really good account of the raid GinnyRED57 put in comments.)

Heavily armed federal agents raided apartment buildings across metro Denver early Wednesday in a search for Venezuelan gang members and other migrants under the Trump administration’s mass deportation effort targeting major cities.

At least two dozen officers carrying high-powered weapons stormed several complexes before sunrise. In some cases, they were backed by large, military-style vehicles.

The Department of Homeland Security said on social media that it was targeting 100 members of the Venezuelan gang Tren de Aragua for arrest and detention. It did not say how many people were taken into custody.

The operation included officers from Immigration and Customs Enforcement; the FBI; the Drug Enforcement Administration; and the Bureau of Tobacco, Alcohol, Firearms and Explosives.

[snip]

At an apartment complex in Denver, a 31-year-old Venezuelan man said that shortly after 5 a.m., ICE agents and other federal officers began yelling and loudly banging on every door.

The man, who asked that his name be withheld because he was afraid of being deported, said residents discreetly peered out their windows as large trucks and unmarked vehicles entered the parking lot.

Several residents said eight people were arrested at the complex.

People “hid with fear,” “didn’t open their doors” and remained “quiet without saying anything,” he said after all the agents had left.

In other words, while ICE had a few specific targets, they had no warrants for the vast majority of residences. They just kept knocking and knocking and knocking. And because the residents knew their rights, they didn’t open up.

It’s probably no surprise that this story from NBC is coming out days after the flopped Aurora raid. Trump is angry that his deportation numbers are falling so far short of what he promised his supporters.

Agents at Immigration and Customs Enforcement are under increasing pressure to boost the number of arrests and deportations of undocumented immigrants, as President Donald Trump has expressed anger that the amount of people deported in the first weeks of his administration is not higher, according to three sources familiar with the discussions at ICE and the White House.

A source familiar with Trump’s thinking said the president is getting “angry” that more people are not being deported and that the message is being passed along to “border czar” Tom Homan, Homeland Security Secretary Kristi Noem, White House Deputy Chief of Staff Stephen Miller and acting ICE Director Caleb Vitello.

“It’s driving him nuts they’re not deporting more people,” said the person familiar with Trump’s thinking.

[snip]

Meanwhile at ICE, Vitello told agents in January to aim to meet a daily quota of 1,200-1,400 arrests. According to numbers ICE has posted on X, the highest single day total since Trump was inaugurated was just 1,100, and the number has fallen since that day. On Tuesday of this week, arrests of immigrants were over 800, according to a source familiar with the numbers. But last weekend, there were only about 300 arrests, another source told NBC News.

In order to fulfill Trump’s Inauguration Day promise of “millions and millions” of deportations, the Trump administration would have to be deporting over 2,700 immigrants every day to reach 1 million in a year.

And, as NBC News has reported, arrests do not always equal immediate detentions, much less deportations. Of the more than 8,000 immigrants arrested in the first two weeks of the Trump administration, 461 were released, according to the White House.

Of course Trump is pissed that his biggest immigration success so far was stolen from Sleepy Joe Biden.

Of course Tom Homan is pissed that he can’t deliver what he promised.

Of course ICE is squirmy because even if they could meet their quotas — even if those migrants in Aurora, CO against whom ICE had no probable cause of a crime willingly opened their doors so ICE could arrest and deport them — the number of deportees would still fall far short of Trump’s goal.

But this all arises from the false expectations set during the election — from the lies Stephen Miller told, over and over and over and over and over, about the number of criminal migrants.

Trump is furious that his thugs can’t fulfill his promises. But those failures arise not through want of trying. Rather, those failures stem from the fact that reality in no way matches the hellhole Miller pitched for Trump, the imaginary hellhole Miller used to get voters afraid enough to vote for Trump.

Trump has redirected virtually all instruments of US national security to chase Stephen Miller’s lies. Not only is it going to lead to ongoing fury from the Boss, because reality will never match the propaganda Miller spun. But by neglecting the things that really do pose much more urgent threats — by destaffing investigations into real terrorists or operations to counter real ransomware attacks — Trump leaves America vulnerable in myriad ways.

The big news overnight in the legal fight to rein in DOGE is that SDNY Judge Paul Engelmayer has ordered Treasury to stop letting Elon Musk’s DOGE [sic] boys to snoop in Treasury’s payment system and destroy any copies of records already made from it. [docket]

the defendants are (i) restrained from granting access to any Treasury Department payment record, payment systems, or any other data systems maintained by the Treasury Department containing personally identifiable information and/or confidential financial information of payees, other than to civil servants with a need for access to perform their job duties within the Bureau of Fiscal Services who have passed all background checks and security clearances and taken all information security training called for in federal statutes and Treasury Department regulations; (ii) restrained from granting access to all political appointees, special government employees, and government employees detailed from an agency outside the Treasury Department, to any Treasury Department payment record, payment systems, or any other data systems maintained by the Treasury Department containing personally identifiable information and/or confidential financial information of payees; and (iii) ordered to direct any person prohibited above from having access to such information, records and systems but who has had access to such information, records, and systems since January 20, 2025, to immediately destroy any and all copies of material downloaded from the Treasury Department’s records and systems, if any;

This order comes on top of Judge Colleen Kollar-Kotelly’s order limiting access to Treasury’s payment system to normal employees and two DOGE [sic] employees, but the latter for read-only access [docket]:

Mr. Tom Krause, a Special Government Employee in the Department of the Treasury, as needed for the performance of his duties, provided that such access to payment records will be “read only”;

Mr. Marko Elez, a Special Government Employee in the Department of the Treasury, as needed for the performance of his duties, provided that such access to payment records will be “read only”;

Anna Bower parsed how DOJ substantiated (or not) that this was really “read only” access. Which was part of what a bunch of Democratic Attorneys General, led by Tish James, pointed to to claim they still needed a TRO, over and above the one issued by Kollar-Kotelly.

The temporary restraining order entered yesterday by the D.C. District Court in Alliance for Retired Americans v. Bessent, No. 1:25-cv-313 (D.D.C.) (“ARA”), does not change this conclusion. That order continues to permit two SGEs affiliated with DOGE to have access to the BFS payment records and payment systems, restricts their access to “read only” just for payment records and not payment systems, and does not direct that any copies of data from the systems made since the Agency Action took effect be destroyed. ARA, Dkt No. 13.

Now, I’m somewhat skeptical that Engelmeyer’s order, as issued, is sustainable. He issued the order in advance of the assigned judge on the case, Jeannette Vargas, and before the government had a chance to respond to the lawsuit.

But the lawsuits to enjoin DOGE [sic] are playing catch-up to the known facts.

And the known facts get us much closer to the being able to prove that Elon and his DOGE [sic] boys are altering code, if not hacking it, rather than simply reviewing its data.

The suit and TRO before Judge Kollar-Kotelly, filed by several unions, is entirely privacy focused.

The state AGs’ suit and TRO, which establish standing by pointing to the billions of dollars of payments they get from the Feds, argues that Elon is attempting to intercept payments to entities Trump doesn’t like. It asserts a claim repeatedly backed in public reporting, but affirmatively denied before Kollar-Kotelly: that the DOGE boys — here, self-proclaimed eugenicist Mark Elez, have altered code.

5. As of February 2, 2025, the President and Treasury Secretary, directed Treasury to grant expanded access to BFS payment systems to political appointees and “special government employees” for reasons that have yet to be provided, although one apparent purpose, upon information and belief. Upon information and belief, one purpose is to allow DOGE to advance a stated goal to block federal funds from reaching beneficiaries who do not align with the President’s political agenda. For example, DOGE was tasked with freezing payments issued by the U.S. Agency for International Development (“USAID”) and sought access to BFS payment systems to accomplish that goal.5 Virtually unfettered access to BFS payment systems was granted to at least one 25-year-old DOGE associate, Mark Elez, who, on information and belief, had the authority to view or modify numerous critical files.6 Indeed, reports indicate that Elez had administrative privileges over the BFS payment system’s code, giving him the ability to alter user permissions and “read and write” code—even if the associate had “read-only” access to the system’s data.7 Elez has since resigned from DOGE after being linked to racist social media posts.8

6. Around the same time that DOGE associates were unlawfully granted access to BFS systems, Mr. Musk began publicly stating his intention to recklessly freeze streams of federal funding without warning. On February 2, 2024, Mr. Musk posted on X (formerly Twitter), an online social media platform, that DOGE is “rapidly shutting down” various “illegal payments” made by the government to grant recipients, including payments to Lutheran Family Services to provide services to migrant children.9 That same day, Mr. Musk posted that his team “spent the weekend feeding USAID into the wood chipper.” Since then, Mr. Musk has unambiguously called for the cancellation of various streams of federal funding. For instance, on February 6, 2025, he alleged: “Billions of taxpayer dollars to known FRAUDULENT entities are STILL being APPROVED by Treasury. This needs to STOP NOW!”10 Mr. Musk has also made wild, unsubstantiated claims about the BFS payment system and suggested putting it on the blockchain.11

6 A 25-Year-Old With Elon Musk Ties Has Direct Access to the Federal Payment System | WIRED

7 https://www.wired.com/story/elon-musk-associate-bfs-federal-payment-system/

8 DOGE Staffer Resigns Over Racist Posts

9 Elon Musk on X: “The @DOGE team is rapidly shutting down these illegal payments” / X

10 Elon Musk on X: “Billions of taxpayer dollars to known FRAUDULENT entities are STILL being APPROVED by Treasury. This needs to STOP NOW!” / X

11 Fatima Hussein, “Elon Musk’s task force has gained access to sensitive Treasury payment systems, sources say,” PBS News, Feb. 2, 2025, https://www.pbs.org/newshour/politics/elon-musks-task-force-hasgained-access-to-sensitive-treasury-payment-systems-sources-say; Billy Bambrough, “‘This Needs To Stop Now’—Elon Musk Confirms Radical Doge U.S. Treasury Plan,” Forbes, Feb. 2, 2025, https://www.forbes.com/sites/digital-assets/2025/02/02/this-needs-to-stop-now-elon-musk-confirmsradical-doge-us-treasury-plan/.

It cites Elon’s insane rants on Xitter as well.

In addition to the privacy concerns addressed in the union lawsuit, the AGs’ lawsuit raises concerns about appropriations (and separation of powers), but also cybersecurity, something not included in the union lawsuit.

139. The conduct of DOGE members presents a unique security risk to States and State residents whose data is held by BFS, given that DOGE employees have already reportedly set up an unauthorized commercial server at another federal agency without a privacy impact assessment as required by the 2002 E-Government Act. Access by DOGE employees to BFS is likely to present even greater risks to the security and privacy of States’ and their residents’ data.

140. Unsecure data is susceptible to cyber attacks and identity theft. Identity theft has a significant impact on States, beyond the financial well-being of its residents. It strains law enforcement resources, damages state economies through lost productivity and consumer confidence, and raises costs for the state to redress fraudulent claims made from stolen identities for unemployment and healthcare benefits. [my emphasis]

The AGs’ suit actually doesn’t cite a source for the claim that DOGE set up a commercial server at another agency. But I think the claim comes from a lawsuit Kel McClanahan filed against Office of Personnel Management, aiming to require it to stop the all-government email DOGE [sic] set up to offer its “Fork in the Road” severance offer. McClanahan first sued, with two plaintiffs who worked at government agencies, on January 27, for a violation of the E-Government Act. [docket]

In response, the government claimed that the main theory of injury, that the government had set up the all-government email without first doing a privacy assessment didn’t apply for employees, and was moot because it had since done one, which it included here. The privacy assessment claimed this was just a Office365 account.

1.3. Has a system security plan been completed for the information system(s) supporting the project? The Office 365 mailbox has been granted an Authorization to Operate (ATO) that includes a system security plan. The government computer storing the data is subject to standard security requirements, including limited PIV access.

And it claimed that the account included only employee data.

2.1. Identify the information the project collects, uses, disseminates, or maintains. GWES collects, maintains, and uses the names and government email addresses of federal government employees. GWES also collects and redistributes responses to emails sent to those addresses, which are limited to short, voluntary, non-identifying information. Specifically, GWES contains the following:

• Employee Contact Data: GWES collects, maintains, and uses the names and government email addresses of federal government employees. Other identifying information is not used.
• Employee Response Data: After an email is sent using Employee Contact Data, GWES collects, maintains, and redistributes short, voluntary responses.

It largely ignored McClenahan’s claim (based largely on Reddit posts) that DOGE had installed a separate server.

But other than speculation on social media, Plaintiffs provide no evidence that OPM took any of the actions that would trigger the PIA requirement under sections 208(b)(1)(A)(i)-(ii) of the E-Government Act. Moreover, Plaintiffs disregard entirely the fact that the E-Government Act does not require a PIA when an agency is seeking to collect information about “agencies, instrumentalities, or employees of the Federal Government.”

Since then, McClanahan filed an amended complaint, which added five more plaintiffs, none of whom are Executive Branch employees (for example, one works for the Library of Congress; another is a contractor), substantiating that some of the DOGE emails went to people outside the Executive Branch, and provided additional substantiation of the Reddit claims (including raising questions about whether this could even be Microsoft365).

30. Furthermore, prior to 20 January 2025, OPM lacked the technical capacity to send direct communications to all Executive Branch employees: But just days before President Donald Trump’s inauguration, OPM did not have the capability to send a mass email of that scale, according to a person familiar with the matter. To send mass emails, the agency had used govDelivery, a cloud communications service provided by public sector IT company Granicus, a different person familiar said. The govDelivery contract had restrictions on the volume of emails available to send without incurring added costs, and the agency would not have been able to reach 2.3 million people, the approximate number of all civilian federal employees, the second person added. David DiMolfetta, OPM’s new email system sparks questions about cyber compliance Nextgov/FCW (Jan. 28, 2025), available at https://www.nextgov.com/digitalgovernment/2025/01/opms-new-email-system-sparks-questions-about-cybercompliance/402555/ (last accessed Feb. 3, 2025).

31. Additionally, OPM has used Microsoft Office 365 since at least 2021, including Outlook 365 for email. OPM, Privacy Impact Assessment for OPM – Microsoft Office 365 (May 13, 2021), available at https://www.opm.gov/information-management/privacy-policy/privacypolicy/office-365-pia.pdf (last accessed Feb. 3, 2025). Outlook 365 cannot send more than ten thousand emails per day. See Microsoft, Exchange Online limits (Dec. 11, 2024), at https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-servicedescription/exchange-online-limits#sending-limits-1 (last accessed Feb. 3, 2025).

32. According to the FedNews Message, “Instead [of using the normal channels], an on-prem (on-site) email server was setup [sic]. Someone literally walked into our building and plugged in an email server to our network to make it appear that emails were coming from OPM. It’s been the one sending those various ‘test’ message[s] [discussed below].” FedNews Message.

33. This statement is supported by recent reporting:

A new server being used to control these [OPM] databases has been placed in a conference room that Musk’s team is using as their command center, according to an OPM staffer. The staffer described the server as a piece of commercial hardware they believed was not obtained through the proper federal procurement process.

Caleb Ecarma & Judd Legum, Musk associates given unfettered access to private data of government employees Musk Watch (Feb. 3, 2025), at https://www.muskwatch.com/p/muskassociates-given-unfettered (last accessed Feb. 3, 2025).

34. Upon information and belief, this server and/or other systems linked to it are retaining information about every individual with a Government email address.

The amended complaint argues that the privacy impact was factually and legally insufficient.

39. Neither Biasini nor Hogan were OPM employees prior to 20 January.

40. Biasini worked at the Boring Company prior to 20 January. It is not currently known if he still works there.

41. Hogan worked at Comma.ai prior to 20 January. It is not currently known if he still works there.

42. The GWES PIA was both factually inaccurate and legally inadequate.

[snip]

54. Upon information and belief, OPM has not ensured review of a PIA for any of these systems by any legally sufficient Chief Information Officer or equivalent official.

55. OPM has not published a legally sufficient PIA or made such an assessment available for public inspection for any of these systems.

In other words, as these twin lawsuits against Treasury get closer to arguing that Elon is not looking for savings but instead altering the payment system, McClanahan continues to chase proof that Elon’s DOGE [sic] boys have added their own server which, by dint of sending emails to everyone (including people not employed by the Executive branch) with a .gov address, is collecting information on everyone with a .gov address.

Meanwhile, several other developments get closer to showing that Elon is hacking the government, not assessing it.

First, late this week, OPM removed access by some DOGE [sic] boys to more sensitive OPM systems.

Directives from the agency’s interim leadership issued late this week indicated that DOGE representatives should be withdrawn from two principal systems containing personally identifiable information for millions of federal employees, according to communications reviewed by The Post and people familiar with the developments who spoke on the condition of anonymity because of the matter’s sensitivity.

Those systems are called Enterprise Human Resources Integration and Electronic Official Personnel Folder. They hold sensitive information about employees of most federal agencies, including addresses, demographic profiles, salary details and disciplinary histories.

The Post reported Thursday morning that DOGE agents had gained access to those systems along with “administrative” access to OPM computer systems. That allowed them sweeping authority to install and modify software on government-supplied equipment and, according to two OPM officials, to alter internal documentation of their own activities.

Meanwhile, both Wired and WaPo have stories describing how a Booz Allen analyst described the DOGE [sic] access as an ““unprecedented insider threat risk;” the analyst was promptly fired.

The review, delivered Monday to Treasury officials by a contractor that runs a threat intelligence center for Treasury’s Bureau of the Fiscal Service, said that DOGE’s access to the payment network should be “immediately” suspended. It also urged Treasury to scour the payments system for any changes approved by affiliates of DOGE, which is overseen by billionaire Elon Musk, the correspondence shows. DOGE stands for Department of Government Efficiency.

A Treasury employee told The Post that the threat center is run by Booz Allen Hamilton, a large federal contractor. The company confirmed it runs the threat center, which it said is embedded within Treasury.

Late Friday, after this article appeared, Booz Allen said it had “removed” a subcontractor who wrote the warning and would seek to retract or amend it. “The draft report was prepared by a subcontractor to Booz Allen and contained unauthorized personal opinions that are not factual or consistent with our standards,” company spokesperson Jessica Klenk said. Booz Allen won more than $1 billion in multiyear U.S. government contracts last year.

In a separate communication a week ago, a high-ranking career official at Treasury also raised the issue of risks from DOGE access in a memo to Treasury Secretary Scott Bessent, including the potential breach of information that could lead to exposure of U.S. spies abroad, according to five people with knowledge of the matter, who spoke on the condition of anonymity to reflect government deliberations. The memo included recommendations to mitigate risks, which Bessent approved, said another person familiar with the matter, who also spoke on the condition of anonymity.

And while the focus at Treasury has been on eugenicist Marko Elez, whom Elon has pushed to be reinstated, closer scrutiny into Edward “Big Balls” Coristine — who is at OPM and possibly HHS — has described he has ties to hackers. Brian Krebs, who was targeted by some people in that crowd, described screen shots that suggest Coristine may have been fired for leaking internal documents to a competitor.

Wired noted that Coristine only worked at Path for a few months in 2022, but the story didn’t mention why his tenure was so short. A screenshot shared on the website pathtruths.com includes a snippet of conversations in June 2022 between Path employees discussing Coristine’s firing.

According to that record, Path founder Marshal Webb dismissed Coristine for leaking internal documents to a competitor. Not long after Coristine’s termination, someone leaked an abundance of internal Path documents and conversations. Among other things, those chats revealed that one of Path’s technicians was a Canadian man named Curtis Gervais who was convicted in 2017 of perpetrating dozens of swatting attacks and fake bomb threats — including at least two attempts against our home in 2014.

And Krebs provides chatlogs showing some of Coristine’s former associates are taking notice.

The Com is the English-language cybercriminal hacking equivalent of a violent street gang. KrebsOnSecurity has published numerous stories detailing how feuds within the community periodically spill over into real-world violence.

When Coristine’s name surfaced in Wired‘s report this week, members of The Com immediately took notice. In the following segment from a February 5, 2025 chat in a Com-affiliated hosting provider, members criticized Rivage’s skills, and discussed harassing his family and notifying authorities about incriminating accusations that may or may not be true.

Bloomberg matched Krebs’ reporting on the reason for Coristine’s firing from Path.

“Edward has been terminated for leaking internal information to the competitors,” said a June 2022 message from an executive of the firm, Path Network, which was seen by Bloomberg News. “This is unacceptable and there is zero tolerance for this.”

A spokesperson for the Arizona-based hosting and data-security firm said Thursday: “I can confirm that Edward Coristine’s brief contract was terminated after the conclusion of an internal investigation into the leaking of proprietary company information that coincided with his tenure.”

Afterward, Coristine wrote that he’d retained access to the cybersecurity company’s computers, though he said he hadn’t taken advantage of it.

“I had access to every single machine,” he wrote on Discord in late 2022, weeks after he was dismissed from Path Network, according to messages seen by Bloomberg. Posting under the name “Rivage,” which six people who know him said was his alias, Coristine said he could have wiped Path’s customer-supporting servers if he’d wished. He added, “I never exploited it because it’s just not me.”

Bloomberg tied Coristine’s past even more closely to organized abuse campaigns.

JoeyCrafter was a member of Telegram groups called “Kiwi Farms Christmas Chat” and “Kiwi Farms 100% Real No Fake No Virus,” both referencing an online forum known for harassment campaigns. Typically, the site has been used to share the personal information of a target, encouraging others to harass them online, in-person, over the phone or by falsely alerting police to a violent crime or active shooter incident at their home.

This is the kind of DOGE boy Elon has thrown at government networks — and thus far, Republicans don’t seem to give a damn that Trump has given these DOGE [sic] boys access to data on virtually all Americans, employee or no.

One thing is clear, however: There’s not a shred of evidence these boys are doing what Elon claims they’re doing.

Most of these new facts — the seeming proof that OPM isn’t doing what it claimed, the insider threat warning, the ties to hackers — are not in the AGs’ suit. And by the time the suits catch up to the facts, the complaints may look quite different.

Update: Corrected that none of the OPM plaintiffs are employees of US Courts (though they did get an email).

There was a big development (and a few smaller ones) in DOGE’s [sic] attempts to start shutting down big parts — Treasury and Office of Personnel Management — of the government.

Before I look at those, I want to look at the order Trump appointee Carl Nichols (a former Clarence Thomas clerk) issued in a lawsuit two unions filed to enjoin the USAID shutdown.

The unions claimed the USAID shutdown violated:

• Separation of powers
• Take care clause
• Administrative Procedure Act because it was in excess of statutory authority
• Administrative Procedure Act because it was arbitrary and capricious

They described the death and destruction the shutdown has caused and will cause.

The agency’s collapse has had disastrous humanitarian consequences. Among countless other consequences of defendants’ reckless dissolution of the agency, halting USAID work has shut down efforts to prevent children from dying of malaria, stopped pharmaceutical clinical trials, and threatened a global resurgence in HIV.40 Deaths are inevitable. Already, 300 babies that would not have had HIV, now do.41 Thousands of girls and women will die from pregnancy and childbirth.42 Without judicial intervention, it will only get worse. The actions defendants plan to take on Friday will “doom billions of dollars in projects in some 120 countries, including security assistance for Ukraine and other countries, as well as development work for clean water, job training and education, including for schoolgirls under Taliban rule in Afghanistan.”43

And they asked for a Temporary Restraining Order on certain actions the government took, which Nichols (after a hearing) construed this way:

Plaintiffs frame their TRO request as pertaining to one overarching event: the allegedly “illegal and unconstitutional dismantling of USAID.” Mot. at 9. But at the TRO hearing, it became clear that plaintiffs’ allegations of irreparable injury flow principally from three government actions: (1) the placement of USAID employees on administrative leave; (2) the expedited evacuation of USAID employees from their host countries; and (3) Secretary Rubio’s January 24, 2025 order “paus[ing] all new obligations of funding . . . for foreign assistance programs funded by or through . . . USAID.” Dep’t of State, Memo. 25 STATE 6828. The Court finds that a TRO is warranted as to the first two actions but not the third.

The request for a Temporary Restraining Order included declarations describing the injuries the shutdown has and will cause, including this one describing the harm a sudden move will cause to an employee’s two special needs kids.

This directive will have profound impacts on the wellbeing of my kids’ personal, educational and psychological development. I have two children at Post: a seven-year-old in first grade and a two-year-old in preschool. Both have received “Class 2” medical clearances from State MED and thus they receive a Special Needs Education Allowance (SNEA) for occupational therapy (OT). My older child has documented gross and fine motor skill delays due to prenatal intrauterine growth restriction (IUGR). My younger child also has documented gross and fine motor skill delays due to torticollis. Both children receive OT services in conjunction with their schooling in a purposefully integrated manner, a best practice promoted by specialists at the State Department ‘s Office of Child and Family Program (CFP) who oversee their care. Additionally, my older child who is in first grade was recently diagnosed by a licensed medical professional with ADHD and anxiety. They are now receiving Cognitive Behavioral Therapy (CBT) at Post from a licensed therapist and the Embassy Medical Unit is tracking their care.

Uprooting my children from their school, OT service providers, and child therapist in the middle of the school year will undoubtedly set back their development with possible lifelong implications. In the United States, we currently have no home or ties to a specific school district. My kids have lived overseas nearly their entire life in service of our country. There will be an inevitable gap – possibly a long one – before they are back in a stable routine of integrated schooling, OT services, and psychological services, a routine that medical professionals have determined they need to overcome developmental delays, and in the case of my seven-year-old, ADHD.

Or this one, describing the danger of losing access to security protections in high risk locations.

Personal Safety Risks: The shutdown could have life-threatening consequences for PSC colleagues serving in high-risk locations. The abrupt shutdown of government devices and access was highly reckless to colleagues in active conflict zones, such as Ukraine and Somalia. Friends and colleagues lost access to the Embassy safety communication channels, and many could no longer use a safety app called “Scry Panic 2.0,” which is installed on government-furnished equipment. In addition, many PSCs serving USAID abroad were unsure if they remained under U.S. chief-of-mission authority, which guarantees access to U.S. Government resources to ensure staff safety and accountability, including for emergency evacuations. U.S. Department of State officials, who were tasked with developing a plan to get USAID officials home, had no instructions or information on the next steps.

Many USAID PSCs work in high-risk environments where access to security resources is critical. I have heard from overseas colleagues who have now lost access to Diplomatic Security systems, meaning they can no longer coordinate security protocols, evacuations, or emergency procedures. Without official communication from USAID leadership, these PSCs remain in dangerous locations without clarity on whether they still have institutional protection. Others fear that in the event of a medical emergency or security threat, they will be forced to rely on personal funds or external assistance, as USAID has not provided guidance on whether existing security protocols still apply to them.

A risk exacerbated, the declaration explains, by the false claims launched against USAID staffers.

PSCs are also at increased risk of physical harm due to the threats, harassment, and misinformation that have accompanied the shutdown. The reckless rhetoric spread on social media and in political discourse has put USAID personnel at risk. I have heard from colleagues who have been labeled as criminals, supporters of terrorists, or Marxists—simply for doing their jobs.

High-profile figures, including Elon Musk and his supporters, have fueled this misinformation, creating a hostile environment where USAID staff fear for their personal safety. With individuals involved in the January 6th insurrection now released, there is a heightened sense of danger that USAID employees could be targeted next. I have colleagues who no longer feel safe in their own homes, with some refusing to leave family members alone out of fear that someone radicalized by online misinformation may try to harm them.

Judge Nichols cited both of those injuries in enjoining the government. He cited the latter risk when disputing the government claim that putting 2,700 USAID employees (500 of whom were already put on leave, the others would have been as of yesterday) was just a “garden-variety personnel action.”

Taking the TRO factors somewhat out of order and beginning with irreparable injury, the Court finds that plaintiffs have adequately demonstrated that their members are facing irreparable injury from their placement on administrative leave, and that more members would face such injury if they were placed on administrative leave tonight. Many USAID personnel work in “highrisk environments where access to security resources is critical.” ECF No. 9-10 ¶ 14. No future lawsuit could undo the physical harm that might result if USAID employees are not informed of imminent security threats occurring in the countries to which they have relocated in the course of their service to the United States. The government argued at the TRO hearing that placing employees on paid administrative leave is a garden-variety personnel action unworthy of court intervention. But administrative leave in Syria is not the same as administrative leave in Bethesda: simply being paid cannot change that fact.

And he cited the former injury when ruling that immediately recalling the officers overseas would create real injury, one not counterbalanced by any pressing government need.

Specifically, whereas USAID’s “usual process” provides foreign service officers with six to nine months’ notice before an international move, plaintiffs allege that USAID has now issued a “mandatory recall notice” that would require more than 1400 foreign service officers to repatriate within 30 days. Mot. at 18.

Plaintiffs have demonstrated that this action, too, risks inflicting irreparable harm on their members. Recalling employees on such short notice disrupts long-settled expectations and makes it nearly impossible for evacuated employees to adequately plan for their return to the United States. For instance, one of plaintiffs’ members attests that, if he is recalled from his foreign post, he will be forced to “[u]proot” his two special-needs-children from school in the middle of the year, “set[ting] back their development with possible lifelong implications.” ECF No. 9-5 ¶ 6. He also attests that, because his family has no home in the United States and his children have “lived overseas nearly their entire life,” there will be “an inevitable gap—possibly a long one—before they are back in a stable routine . . . that medical professionals have determined they need to overcome developmental delays.” Id. Other of plaintiffs’ members tell similar stories, explaining that the abrupt recall would separate their families, interrupt their medical care, and possibly force them to “be back in the United States homeless.” See ECF ECF No. 9-4 ¶ 7; ECF No. 9-5 ¶ 8; ECF No. 9-9 ¶ 6. Even if a future lawsuit could recoup any financial harms stemming from the expedited evacuations—like the cost of breaking a lease or of abandoning property that could not be sold prior to the move—it surely could not recoup damage done to educational progress, physical safety, and family relations.

But perhaps the most important language in Judge Nichols’ short opinion was his disdain for the government’s flimsy claims that the USAID employees have to be put on leave because of vague claims of fraud.

When the Court asked the government at the TRO hearing what harm would befall the government if it could not immediately place on administrative leave the more than 2000 employees in question, it had no response— beyond asserting without any record support that USAID writ large was possibly engaging in “corruption and fraud.”

That is, when pushed to justify this purge to a sympathetic Trump appointee, DOJ simply couldn’t substantiate claims of fraud.

To be sure, Nichols only enjoined the government until February 14. And he didn’t reverse the freeze on funding — notwithstanding that the government likely lied in saying that the freeze only applied to prospective funding obligations.

As a threshold matter, the Court notes that there are significant factual questions about what the practical effect of that order is. The government argued at the hearing that the order only prevents USAID from entering “new obligations of funding”—leaving it free to pay out contracts that it entered into prior to January 24, 2025—and indeed, the text of the order does seem to permit that result. Dep’t of State, Memo. 25 STATE 6828. Yet, plaintiffs maintained at the TRO hearing that payments on existing USAID grants have been frozen, preventing certain “contracting officers” employed by USAID from using agency funds to fulfill monetary commitments that the agency had already made.

But Trump’s administration had a chance to substantiate the wild claims of fraud and abuse that Elon Musk has leveled at USAID.

And Carl Nichols was unimpressed.