Court filing: DOGE aide broke Treasury policy by emailing unencrypted database(theregister.com)
theregister.com
Court filing: DOGE aide broke Treasury policy by emailing unencrypted database
https://www.theregister.com/2025/03/17/doge_treasury/
38 comments
what hyperbole. it’s just names and a dollar amount.
My credit report is just names and dollar amounts too. I don’t want the whole world having access to it.
heh. That's cute.
You may not "want" that. However, given the lack of consumer privacy laws in the US, anybody willing to pay can buy it from a data broker[1].
[1] https://www.experian.com/small-business/target-prospects
You may not "want" that. However, given the lack of consumer privacy laws in the US, anybody willing to pay can buy it from a data broker[1].
[1] https://www.experian.com/small-business/target-prospects
That sounds like an admission that it’s a bad thing and not an argument about why Musk’s department should be allowed to do more of the same with even less oversight.
hyperbole would be the wrong word. It think misinformation would be the correct word since the allegations were false rather than exaggerated.
Why would there even need to be a war, when you can just buy the country?
I thought they were emailing around social security numbers till I got to the end of the article.
[deleted]
[deleted]
teddyh(2)
rayiner(3)
How does one email a database? With rare exceptions most mail servers have attachment limits of 16MB to 32MB. Just the schema alone could use up a chunk of the attachment limits. Is the title just oddly worded perhaps? Maybe they meant specific query results?
[Edit] Based on replies specific query results of two people names and dollar amounts into a spreadsheet. Poorly worded title on El Reg's part. Still a security privacy and compliance incident.
[Edit] Based on replies specific query results of two people names and dollar amounts into a spreadsheet. Poorly worded title on El Reg's part. Still a security privacy and compliance incident.
From case witness testimony https://storage.courtlistener.com/recap/gov.uscourts.nysd.63...
12. The forensic analysis also revealed that Elez sent an email with a
spreadsheet containing PII to two United States General Services Administration
officials. The PII detailed a name, a transaction type, and an amount of money.Everyone in this thread should read this filing; it's only a couple of pages.
Previous background on Ryan Wunderly and Marko Elez: https://www.politico.com/news/2025/02/20/treasury-irs-data-w...
"Treasury said Ryan Wunderly will replace Marko Elez on the agency’s DOGE team. Elez examined the federal payments system housed at the Bureau of the Fiscal Service before he resigned from Treasury earlier this month after The Wall Street Journal surfaced racist social media posts."
Previous background on Ryan Wunderly and Marko Elez: https://www.politico.com/news/2025/02/20/treasury-irs-data-w...
"Treasury said Ryan Wunderly will replace Marko Elez on the agency’s DOGE team. Elez examined the federal payments system housed at the Bureau of the Fiscal Service before he resigned from Treasury earlier this month after The Wall Street Journal surfaced racist social media posts."
Isn't the cat already out of the box? If the White House and its dictator are agreeing to it it could mean they don't need full access anymore.
OK that makes a lot more sense. Thankyou.
The actual filing (which is linked from the article) is more specific in its claims:
>The forensic analysis also revealed that Elez sent an email with a spreadsheet containing PII >to two United States General Services Administration officials.
https://storage.courtlistener.com/recap/gov.uscourts.nysd.63...
The word "database" never appears in the filing, that's The Register's word choice.
>The forensic analysis also revealed that Elez sent an email with a spreadsheet containing PII >to two United States General Services Administration officials.
https://storage.courtlistener.com/recap/gov.uscourts.nysd.63...
The word "database" never appears in the filing, that's The Register's word choice.
"database" in legal/business speak (AFAIK) is the more general "organized collection of data" - not the more software engineer focused relational/object/graph- implementations of such.
Export into CSV, attach, done. 10MB can contain a million people's PII.
He’s already resigned because he was linked to racist and abhorrent social commentary; the export was considered low-risk; and based on what happened between coequal branches of government this week, the Administration feels they’re accountable to no one.
So; not a paddlin’.
So; not a paddlin’.
He was reinstated quickly at the order of the vice president. It's been strange getting older and seeing aspects of politics I thought were fairly fundamental quickly change. I remember not too long ago when accusations of racism were considered slanderous attacks by liberals on conservatives, and now they are apparently reveling in racism because it bothers liberals. It's no way to run a government if you ask me, but no one seems interested in my (seemingly) outdated opinions.
> accusations of racism were considered slanderous attacks by liberals on conservatives, and now they are apparently reveling in racism because it bothers liberals
They're quite capable of doing both of these at the same time.
They're quite capable of doing both of these at the same time.
Unless he's resigned again in recent weeks and I've missed it, Elez was brought back within days of his resignation after a short campaign to manufacture consent by JD Vance and Musk.
I bet it was an Excel file and he failed to password-zip it )
It might surprise the good readers of Hacker News, but by reading TFA, and the linked PDF therein, answers may be revealed!
> 12. The forensic analysis also revealed that Elez sent an email with a spreadsheet containing PII to two United States General Services Administration officials. The PII detailed a name (aperson or an entity), a transaction type, and an amount of money. The names in the spreadsheet are considered low risk PII because the names are not accompanied by more specific identifiers, such as social security numbers or birth dates. Elez’s distribution of this spreadsheet was contrary to BFS policies, in that it was not sent encrypted, and he did not obtain prior approval of the transmission via a “Form 7005,” describing what will be sent and what safeguards the sender will implement to protect the information.
> 12. The forensic analysis also revealed that Elez sent an email with a spreadsheet containing PII to two United States General Services Administration officials. The PII detailed a name (aperson or an entity), a transaction type, and an amount of money. The names in the spreadsheet are considered low risk PII because the names are not accompanied by more specific identifiers, such as social security numbers or birth dates. Elez’s distribution of this spreadsheet was contrary to BFS policies, in that it was not sent encrypted, and he did not obtain prior approval of the transmission via a “Form 7005,” describing what will be sent and what safeguards the sender will implement to protect the information.
This is exactly what the court filing says - he emailed excel spreadsheets with unencrypted data. Presumably from database queries hence why they mention emailing a database. Obviously written by people who are entirely unfamiliar with what a database even is so it makes it sound worse than it is (even though it is still bad, but not quite "send the entire database" bad.)
Clearly a computer genius, he is using Excel....
Yep
Given a desired message size of max_bytes megabytes (in reality the messages will be smaller due to the use of gzip), a database dump command which dumps the database to stdout, a correctly configured mail environment and a destination address of [email protected]:
$ RCPT="[email protected]" database_dump_command | split -b max_bytes M --filter="gzip -| base64 | mail -s \$FILE \$RCPT"
$ RCPT="[email protected]" database_dump_command | split -b max_bytes M --filter="gzip -| gpg -r \$RCPT -e -a | mail -s \$FILE \$RCPT"The manual way of copying a DB or part of it is export to CSV in my experience.
You can store A LOT in that format in 16MB.
You can store A LOT in that format in 16MB.
This damage won't be fixed within the lifetime of anyone alive today.
We won't even see WW3 coming, just tiny footsteps and then BOOM some morning.