They shared the site plans with everyone and called it not exposed externally. I know the sentence. It is the one an institution reaches for when the door was open the whole time and nobody it is willing to count walked through. Externally. As if the danger to a courthouse floor plan stops at the org chart. As if a contractor with a login is family. I spent years at the You Know Who Post in a cardigan that cost more than a security clearance background check, writing gentle copy about how the federal government needed to “modernize,” and modernize it did: it moved the filing cabinet to the cloud and left the drawer open in a nicer font.
Here is the record. The General Services Administration’s Office of Inspector General released an audit Tuesday, Oct. 27, 2026, finding that the agency “did not effectively protect” physical security information, personal data and proprietary business information in its Google Drive, Nextgov/FCW’s Christian Robles reported Oct. 29. In a limited search, the watchdog found 116 files containing controlled unclassified information — CUI — shared with employees and contractors who had no legitimate business reason to see them. ExecutiveGov reported the same day that the 116 files were open to every GSA Google Drive user, contractors included, that more than half held building security information and five held personal data, and that among the building records were Washington, D.C., site plans covering entrances and screening areas, a progressive collapse analysis and floor plans marking spaces such as judges’ chambers. Social Security numbers, birth dates, phone numbers and addresses turned up too, along with vendor proposals carrying technical and pricing detail. GSA management estimates employees and contractors store 2.5 million documents in that drive; this was a sample. As of September, the agency had spent $7.8 million on a third-party data loss prevention tool meant to catch exactly this, and the tool did not flag about a third of the files even though they carried an “official use only” marking or a variant. GSA hadn’t fully completed its annual reviews of the tool’s search terms, left out “many relevant terms” from its own CUI guidance, didn’t turn on the tool’s optical character recognition feature, and “was not aware” the tool skips files over 15 megabytes, the OIG wrote. It also had no approval process for sharing sensitive files and no naming convention for them. And this is not news to the watchdog: in August 2014 it reported GSA had failed to protect information about child care centers, courthouses, water sources, building automation, security and fire alarm systems in the same Google environment, then raised concerns again in reports from 2015 to 2017, and again in April 2025.
Now the defense, and they filed one. GSA’s chief information officer, David Shive, wrote that GSA IT’s review found the documents “not exposed externally” and saw “no indication of malicious intent.” He agreed with all seven recommendations, said the agency is “working on a plan to address them,” and said GSA took “significant corrective action” during the audit — updating procedures, restricting domain-wide sharing “as appropriate,” and adopting the optical character recognition the OIG asked for. Fine. Agreeing with your inspector general is cheaper than arguing with one, and I believe somebody really did switch the feature on. But read what the defense is defending. Not the 116 files. Not the third the tool missed. Not the twelve years. It is defending the perimeter — the idea that the inside of a government is a safe room by definition, that a judge’s chamber on a floor plan is fine as long as only the people with badges, and the people with contractor badges, and whoever they hand a laptop to, can open it. That is the state’s favorite category error: it trusts itself by default and audits everyone else. The $7.8 million tool didn’t fail. It did what it was configured to do by people who did not read its manual.
Deb kept the church directory in a three-ring binder in a locked cabinet and still made the youth pastor sign for it. Buck says his tackle box has a better access-control policy than the federal real-estate agency, and that the tackle box is also not exposed externally because it lives in the garage. I love them. They are seasoning.
“Not exposed externally” is the alibi. The 116 files are the story. Sit with them until they confess. An agency whose whole job is running federal buildings left the security geometry of those buildings — where you enter, where you get screened, how the structure collapses — open to its entire drive, paid $7.8 million for a guard that couldn’t read big files, and has been told about the same cloud since 2014. Maybe the plan will be excellent. I hope it is; the people in those buildings deserve a locked drawer. But a government that keeps grading its own perimeter as safe is not protecting anyone. It is protecting the word “internal.” The cardigan stays. Fill the notebook. Then ask your member of Congress, out loud, before the next appropriation for the next tool: how many of the other 2.5 million documents have been checked, who outside the 116 ever opened them, and why did it take a sample search by the inspector general to find what the $7.8 million was bought to find?
Sources:
- Nextgov/FCW, Christian Robles, “GSA left sensitive information in its Google Drive exposed, watchdog finds,” Oct. 29, 2026
- ExecutiveGov, Mendel Cohen, “GSA Inspector General Finds 116 Sensitive Files Open to All Agency Users in Google Drive,” Oct. 29, 2026
— Theo Ashford-Lindström
Leave a Reply