CLAIM: DOGE posts classified information on its website

[fizzBuzz]

Last week, the media went wild over DOGE posting "classified information" on its website. DOGE has a page showing the government's hierarchical structure and it displays the head count and total employee wages for each department. Among this hierarchy are several intelligence agencies, one being the NRO (National Reconnaissance Office), which is the dept in question. The claim is that intelligence agency head counts and budgets are classified information (tho DOGE does not show the budget for this office).
https://doge.gov/workforce?orgId=69ee18bc-9ac8-467e-84b0-106601b01b90

This is the DOGE link to the NRO listing:
https://doge.gov/workforce?orgId=cef54cef-6e43-486d-aa0a-b1a7d5841a72

ABC News even says:

Multiple intelligence community sources told ABC News that this likely represents a significant breach.

https://abcnews.go.com/US/agency-data-shared-doge-online-sparks-concern-intelligence/story?id=118858837#:~:text=The DOGE website, updated earlier,intelligence satellites, according to a

This Huffpost article states the White House released a statement addressing the concern, but then immediately follows suggesting the classified information was not removed.

Hours after this story published, a White House spokesperson said in a statement that DOGE did not share classified information ― even as NRO's classified information was still accessible on DOGE's website.

https://www.huffpost.com/entry/elon-musk-doge-posts-classified-data_n_67ae646de4b0513a8d767112

https://www.yahoo.com/news/doge-website-posts-classified-information-215218305.html

This is the headline for DailyMail's article!!!

DOGE leaks secret information about intelligence agencies on its website - sending spies scrambling

https://www.dailymail.co.uk/news/ar...ion-intelligence-agencies-website-hacked.html

All of this data is public and available for download from the Office of Personnel Management's website:
https://www.opm.gov/data/datasets/

The download is a ZIP file containing multiple TXT files that represent some personnel database. If you look at the "DTagy.txt" (this is a Departments table) file in Notepad, you can search for "recon" and will find the NRO record which has a department code of "DD82". If you then open the "FACTDATA_*.txt" file (this is an employees table) and search "DD82", you will find all of the employees that work under the NRO. Which you could sum to get a head count, and each record lists the person's salary. It's clear that the entire DOGE webpage in question is just taking this data and putting it into a user-friendly format.

Sidenote:
I was able to find a statement from the NRO of them achieving a clean audit in November of last year. Near the bottom, it says they use a public accounting firm to audit their financials... Doesn't sound so classified to me, though I cannot verify this.
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://www.nro.gov/Portals/135/Documents/news/press/2024/NRO%2520achieves%2520unprecedented%252016th%2520clean%2520financial%2520audit_FINAL.pdf%3Fver%3Dj1O9Ov0msqP0dVO32GvowQ%253D%253D&ved=2ahUKEwj4vKyJlcSLAxW3G9AFHadiNkwQFnoECGIQAQ&usg=AOvVaw1hIY0uSCYqPQMdOimul0nZ

EDIT: Added link to DOGE NRO department listing.

 

[Mick West]

Among this hierarchy are several intelligence agencies, one being the NRO (National Reconnaissance Office), which is the dept in question. The claim is that intelligence agency head counts and budgets are classified information (tho DOGE does not show the budget for this office).
https://doge.gov/workforce?orgId=69ee18bc-9ac8-467e-84b0-106601b01b90

Where's the NRO data on the web site? Can you link to it? Has it been removed?

You can't really claim this has been debunked if we can't see what data was posted.

Since the NRO is an intelligence agency, and all the other intelligence agencies were not listed, it seems reasonable that it's inclusion was a mistake - especially if it has been removed

 

[fizzBuzz]

Where's the NRO data on the web site? Can you link to it? Has it been removed?

You can't really claim this has been debunked if we can't see what data was posted.

Since the NRO is an intelligence agency, and all the other intelligence agencies were not listed, it seems reasonable that it's inclusion was a mistake - especially if it has been removed

I added the link to the OP

 

[fizzBuzz]

Where's the NRO data on the web site? Can you link to it? Has it been removed?

You can't really claim this has been debunked if we can't see what data was posted.

Since the NRO is an intelligence agency, and all the other intelligence agencies were not listed, it seems reasonable that it's inclusion was a mistake - especially if it has been removed

The point is that it's clear the NRO employee information is public. Or at least head counts and salaries are public information, which is contrary to what the articles claim.

 

[fizzBuzz]

Since the NRO is an intelligence agency, and all the other intelligence agencies were not listed, it seems reasonable that it's inclusion was a mistake - especially if it has been removed

I'm not sure what all agencies are categorized as "intelligence", but I would imagine the "Defense Intelligence Agency" would be. It is also listed on DOGE's website with no data - so maybe this data is classified or not publicly available.. ?
https://doge.gov/workforce?orgId=60caf34b-2f18-4910-9cd2-90e0312296ac

 

[fizzBuzz]

I pulled the data into Excel and these are the results:
The blue highlighted cells are the row count and summed wages. Some of the salaries had a leading apostrophe(') for some reason, so I had to trim those for it to recognize as a number.

Here is a screenshot of the DOGE NRO department listing (https://doge.gov/workforce?orgId=cef54cef-6e43-486d-aa0a-b1a7d5841a72):

 

[fizzBuzz]

I think this is pretty much debunked, @Mick West would you agree? Or should the claim now be the OPM is releasing classified data? lol

 

[NoParty]

If what chief data officer for the Social Security Administration (SSA), Charles Borges, now says is true:

"Should bad actors gain access to this cloud environment, Americans may be susceptible to widespread identity theft, may lose vital healthcare and food benefits, and the government may be responsible for re-issuing every American new Social Security Number at great cost"

this would be one of DOGE's most despicable acts yet. Given DOGE's established incompetence and utter disregard
for the economic security of everyday Americans, whistleblower Borges' disclosures come as little surprise.

https://www.nbcnews.com/politics/do...a-risky-server-whistleblower-alleg-rcna227259

 

[Tezcatlipoca]

I think this is pretty much debunked, @Mick West would you agree? Or should the claim now be the OPM is releasing classified data? lol

I hadn't caught this before only responding to clear up some of the above.

So, what DOGE released there was not necessarily classified, just not preferable to be released. In fact all of that information had been publicly posted on NROs own website before and is available in a few other spots like congressional records. You pretty much got that correct from the jump.

 

[Ann K]

If what chief data officer for the Social Security Administration (SSA), Charles Borges, now says is true:

"Should bad actors gain access to this cloud environment, Americans may be susceptible to widespread identity theft, may lose vital healthcare and food benefits, and the government may be responsible for re-issuing every American new Social Security Number at great cost"

this would be one of DOGE's most despicable acts yet. Given DOGE's established incompetence and utter disregard
for the economic security of everyday Americans, whistleblower Borges' disclosures come as little surprise.

https://www.nbcnews.com/politics/do...a-risky-server-whistleblower-alleg-rcna227259

The claim I have seen is not that DOGE has released that, but that they transferred all the data to an insecure server with cloud storage. Borges has just made that claim a few hours ago, so Snopes and other fact-checkers have not yet made a complete investigation. It's certainly far too soon to call it a false claim.

 

[Hevach]

Also note that "insecure" is a long way from "clear web visible" - security is about a lot of hypotheticals and the paths for them to abruptly become practicals. A door can be both locked and insecure if not enough aspects of the door, lock, and wall are known or controlled.

Cloud storage is particularly fraught because what looks like one computer to you is an account on a server full of accounts, in a room full of other servers, and you don't get to audit any of it yourself. A single compromised account in that whole room could give a path to access your data, and you might never know until it shows up on wikileaks.

There's certain kinds of data that are just bad practice to store in this kind of system.

 

[MonkeeSage]

Cloud storage is particularly fraught because what looks like one computer to you is an account on a server full of accounts, in a room full of other servers, and you don't get to audit any of it yourself. A single compromised account in that whole room could give a path to access your data, and you might never know until it shows up on wikileaks.

In Borges' full whistleblower complaint it's also alleged that the cloud environment the data was transferred to was a testing environment, which also increases the risk.

Excerpt:

On June 11, 2025, the request appeared to have changed to a request to transfer NUMIDENT to a test environment.[48] Based on Mr. Borges' experience and expertise, this was an odd but not unheard of request, as it is atypical and strongly discouraged to move production data to a test environment. Later that morning, it became clear that DOGE's request again changed, at this point, they wanted full administrative access to the cloud environment.[49]

ii. OCIO Identifies DOGE Request as Very High Risk

To Mr. Borges' knowledge, on June 12, 2025, a career official in the Office of the Chief Information Officer (OCIO) shared a formal "Risk Acceptance Request Form" with Aram Moghaddassi and an SSA career executive apparently responding to the June 10-11 request to have administrative access to "their own Virtual Private Cloud (VPC, "cloud") within the SSA Amazon Web Services – Agency Cloud Infrastructure (AWS-ACI)."[50] In sharing this risk assessment, the CIO career official noted that the request was "high-risk"[51] due to the proposal to include a replica copy of NUMIDENT, production data considered a High-Value Aset (HVA), in a development environment as "most security exposures and breaches occur within development environments due to reduced control measures and oversight."[52]

[...]

Mr. Borges has received reports that at some point after DOGE's administrative access was granted on June 24th, a decision was made by OIS that it was impermissible to move NUMIDENT production data to a test cloud environment. On June 25, 2025, CIO officials elevated a further developed request to Michael Russo.[61] At this point, it appeared that John Solly was requesting that NUMIDENT production data be copied from an environment managed by DIS, per policy, to the DOGE specific cloud environment that lacked independent security controls, and that this requested access bypassed proper SAM protocol.[62] CIO officials, evidently aware of the risk involved in copying "live data rather than the usual sanitized data" typically used for development testing, asked DOGE-affiliated Michael Russo to authorize the transfer of NUMIDENT data.[63] Russo responded to this request with a simple, "Approved…."[64]

Mr. Borges reasonably believes that this approval constitutes gross mismanagement, abuse of authority, violation of law, and substantial and specific threat to public health and safety. The transfer of NUMIDENT data to a production account constructed as outlined in the risk assessment above entails replicating live SSA data on millions of Americans to an environment apparently lacking in independent security controls, including independent tracking of who is accessing the data and how they are using it.

In late June 2025, it was reported to Mr. Borges that no verified audit or oversight mechanisms existed over the DOGE cloud environment set up outside of DIS control, and no one outside the former DOGE group had insight into code being executed against SSA's live production data.

Source: https://whistleblower.org/wp-content/uploads/2025/08/08-26-2025-Borges-Disclosure-Sanitized.pdf