... Democratic lawmakers are calling for an investigation after a tech staffer at the US National Labor Relations Board (NLRB) blew the whistle on the ------------ DOGE's activities at the employment watchdog -- which the staffer claims included being granted superuser status in contravention of standard operating procedures, exfiltrating data, and seemingly leaking credentials to someone with a Russian IP address. ...
According to Berulis' disclosure, DOGE operatives arrived at the agency on March 3 in a black SUV that enjoyed a police escort. The same day, he claims, an agency assistant chief information officer (ACIO) told him that DOGE aides would be given accounts "with essentially unrestricted permission to read, copy, and alter data." Creation of such accounts was not standard operating procedure, but the ACIO said those rules must be ignored and the opening of the accounts was not to be logged.
Berulis's document points out that not even his CIO enjoyed the level of access given to DOGE unit operatives, and that the NLRB already had auditor accounts set up that provided enough privileges to check data without being able to edit, copy, or remove it. The "suggestion that they use these accounts instead was not open to discussion," he wrote.
"In the same conversation it was conveyed that we were to hand over any requested accounts, stay out of DOGE's way entirely, and assist them when they asked," he recounted.
Within days, Berulis says, he began to notice worrying signs, such as alerting and monitoring tools being switched off and changes to multi-factor authentication.
He also observed "gigabytes" of data "exiting" a case management application called NxGen over the network, and claimed he later saw 10 GB of data exfiltrated from the agency. ...
[emphasis mine]
