Tax data is also way more sensitive than just SSN, as it includes details about salary, investments, property ownership, marital status, what organizations one supports financially, etc.
Treasury payments also go to companies, including companies engaged in highly sensitive projects like classified weapons systems.
This is all just off the top of my head as someone who is somewhat familiar with the federal government. The article is worth a read for more details.
Typically security of this data is aided by compartmentalization; no one has access to aggregate and collate it all. But now random people do.
And typically the people who secure and work with this data are carefully vetted to reduce the chance they are disgruntled, blackmailed, etc. But now it’s a bunch of random young guys with no clearances or background checks.
And usually many of these systems are air gapped from the Internet. But now they are being accessed with consumer laptops off the street and data is sent off in clear text to commercial data centers where it is likely logged, copied, stored.
It is a real problem that is being swept aside through political signaling. But the real consequences will likely bother Americans for a long time.
DOGE are not random people, they are government employees using government owned laptops to do audit on the orders of the President (DOGE is a renamed US Department of Digital Services).
Just because they analyze the data, journalists assume something nefarious going on, without the actual knowledge of actual risks:
Based on what they do, they only need read-only access to the General ledger transactions. I highly doubt they have access to modify COBOL programs on Treasury mainframes, but rather just operate off of read-only replicas/backups to read and analyze the data.
there are no risks to the Tresury system in this scenario.
DOGE staff are bringing laptops in themselves. The previous U.S. Digital Service staff are firewalled from DOGE, including the IT teams who issue and manage equipment.
And DOGE staff are using these random laptops to copy all this sensitive data into private cloud accounts for storage and analysis.
That level of exfiltration of sensitive data is nefarious, and illegal, which is why a federal judge has issued an order to halt it.
Please read the linked article. It’s by a deeply experienced and well-regarded security expert. I get that people are excited to dig out fraud, but sensitive data must remain secure in the process.
SSNs are being leaked every year by every large consumer and finance company, its not even that much of an issue anyways.
SSN is not supposed to be secret info anyways, and any system that allows stealing money just because someone happens to know SSN - deserves to go bankrupt
[1] https://www.foxnews.com/politics/treasury-mistakenly-gave-mu...