{"id":630,"date":"2026-10-30T21:03:20","date_gmt":"2026-10-30T21:03:20","guid":{"rendered":"https:\/\/thetheolowgen.com\/?p=630"},"modified":"2026-10-30T21:03:20","modified_gmt":"2026-10-30T21:03:20","slug":"they-shared-the-site-plans-with-everyone-and-called-it-not-exposed-externally-the-general-services-administrations-own-inspector-general-found-116-files-of-controlled-unclassified-informati","status":"publish","type":"post","link":"https:\/\/thetheolowgen.com\/?p=630","title":{"rendered":"THEY SHARED THE SITE PLANS WITH EVERYONE AND CALLED IT NOT EXPOSED EXTERNALLY | The General Services Administration\u2019s own inspector general found 116 files of controlled unclassified information \u2014 building site plans showing entrances and screening areas, a progressive collapse analysis, floor plans marking judges\u2019 chambers, Social Security numbers \u2014 open to every employee and contractor on the agency\u2019s Google Drive, after GSA spent $7.8 million on a data-loss-prevention tool that missed about a third of them and couldn\u2019t read files over 15 megabytes, twelve years after the same watchdog flagged the same cloud in 2014; the agency\u2019s answer is that nothing was \u2018exposed externally\u2019"},"content":{"rendered":"\n

They shared the site plans with everyone and called it not exposed externally. I know the sentence. It is the one an institution reaches for when the door was open the whole time and nobody it is willing to count walked through. Externally. As if the danger to a courthouse floor plan stops at the org chart. As if a contractor with a login is family. I spent years at the You Know Who Post in a cardigan that cost more than a security clearance background check, writing gentle copy about how the federal government needed to \u201cmodernize,\u201d and modernize it did: it moved the filing cabinet to the cloud and left the drawer open in a nicer font.<\/p>\n\n\n\n

Here is the record. The General Services Administration\u2019s Office of Inspector General released an audit Tuesday, Oct. 27, 2026, finding that the agency \u201cdid not effectively protect\u201d physical security information, personal data and proprietary business information in its Google Drive, Nextgov\/FCW\u2019s Christian Robles reported Oct. 29. In a limited search, the watchdog found 116 files containing controlled unclassified information \u2014 CUI \u2014 shared with employees and contractors who had no legitimate business reason to see them. ExecutiveGov reported the same day that the 116 files were open to every GSA Google Drive user, contractors included, that more than half held building security information and five held personal data, and that among the building records were Washington, D.C., site plans covering entrances and screening areas, a progressive collapse analysis and floor plans marking spaces such as judges\u2019 chambers. Social Security numbers, birth dates, phone numbers and addresses turned up too, along with vendor proposals carrying technical and pricing detail. GSA management estimates employees and contractors store 2.5 million documents in that drive; this was a sample. As of September, the agency had spent $7.8 million on a third-party data loss prevention tool meant to catch exactly this, and the tool did not flag about a third of the files even though they carried an \u201cofficial use only\u201d marking or a variant. GSA hadn\u2019t fully completed its annual reviews of the tool\u2019s search terms, left out \u201cmany relevant terms\u201d from its own CUI guidance, didn\u2019t turn on the tool\u2019s optical character recognition feature, and \u201cwas not aware\u201d the tool skips files over 15 megabytes, the OIG wrote. It also had no approval process for sharing sensitive files and no naming convention for them. And this is not news to the watchdog: in August 2014 it reported GSA had failed to protect information about child care centers, courthouses, water sources, building automation, security and fire alarm systems in the same Google environment, then raised concerns again in reports from 2015 to 2017, and again in April 2025.<\/p>\n\n\n\n

Now the defense, and they filed one. GSA\u2019s chief information officer, David Shive, wrote that GSA IT\u2019s review found the documents \u201cnot exposed externally\u201d and saw \u201cno indication of malicious intent.\u201d He agreed with all seven recommendations, said the agency is \u201cworking on a plan to address them,\u201d and said GSA took \u201csignificant corrective action\u201d during the audit \u2014 updating procedures, restricting domain-wide sharing \u201cas appropriate,\u201d and adopting the optical character recognition the OIG asked for. Fine. Agreeing with your inspector general is cheaper than arguing with one, and I believe somebody really did switch the feature on. But read what the defense is defending. Not the 116 files. Not the third the tool missed. Not the twelve years. It is defending the perimeter \u2014 the idea that the inside of a government is a safe room by definition, that a judge\u2019s chamber on a floor plan is fine as long as only the people with badges, and the people with contractor badges, and whoever they hand a laptop to, can open it. That is the state\u2019s favorite category error: it trusts itself by default and audits everyone else. The $7.8 million tool didn\u2019t fail. It did what it was configured to do by people who did not read its manual.<\/p>\n\n\n\n

Deb kept the church directory in a three-ring binder in a locked cabinet and still made the youth pastor sign for it. Buck says his tackle box has a better access-control policy than the federal real-estate agency, and that the tackle box is also not exposed externally because it lives in the garage. I love them. They are seasoning.<\/p>\n\n\n\n

\u201cNot exposed externally\u201d is the alibi. The 116 files are the story. Sit with them until they confess. An agency whose whole job is running federal buildings left the security geometry of those buildings \u2014 where you enter, where you get screened, how the structure collapses \u2014 open to its entire drive, paid $7.8 million for a guard that couldn\u2019t read big files, and has been told about the same cloud since 2014. Maybe the plan will be excellent. I hope it is; the people in those buildings deserve a locked drawer. But a government that keeps grading its own perimeter as safe is not protecting anyone. It is protecting the word \u201cinternal.\u201d The cardigan stays. Fill the notebook. Then ask your member of Congress, out loud, before the next appropriation for the next tool: how many of the other 2.5 million documents have been checked, who outside the 116 ever opened them, and why did it take a sample search by the inspector general to find what the $7.8 million was bought to find?<\/p>\n\n\n\n

Sources:<\/strong><\/p>\n\n\n\n