Department of Government Efficiency (DOGE) and social security data

What This is

• Multiple outlets report that DOJ court filings say DOGE staff assigned to the Social Security Administration improperly accessed and shared sensitive SSA data.
• Reports say the filings describe SSA data being shared through unapproved third-party infrastructure, including links routed via Cloudflare, outside SSA-approved procedures.
• Multiple outlets report SSA and DOJ said they still cannot verify the full scope of what data was exposed, whether outside parties accessed it, or how it may have been used.
• Many reports say two DOGE staffers signed or used a “Voter Data Agreement” and discussed helping a political advocacy group match SSA data with voter rolls, prompting Hatch Act referrals.
• Coverage says lawmakers and advocacy groups, including AARP, are calling for accountability and tighter safeguards around access to Social Security data.

Why This Matters

• This issue matters because the Social Security Administration holds highly sensitive personal information, and the DOJ and SSA court filings described across outlets raise questions about whether government data-handling and security controls were followed when DOGE staff accessed and shared SSA records.
• If information was transmitted using unapproved third-party infrastructure (including links routed through Cloudflare) or shared outside normal SSA data-exchange procedures, it can weaken audit trails, complicate incident response, and increase the risk of unauthorized access—even if officials say they cannot yet confirm the full scope of exposure or whether outside recipients actually obtained the data.
• The reported involvement of a political advocacy group seeking to analyze voter rolls expands the stakes beyond cybersecurity to governance and public trust, because it implicates rules that separate federal operations from partisan political activity, including potential Hatch Act concerns.
• With lawmakers and groups like AARP pressing for answers, the disclosures could lead to investigations, court-imposed limits, new access controls for embedded teams, and broader policy changes on how interagency or external data sharing is approved, logged, and monitored.