conv.

All stories
SecurityQuiet 13d · day 13

GSA audit finds 116 sensitive files improperly shared on Google Drive

Inspector General report reveals repeated failures to protect controlled unclassified information since 2014.

newest coverage 13d agosummary written 13d ago4 pieces NewswiresMastodon

What to know

  • GSA audit found 116 files with controlled unclassified information improperly shared with all employees and contractors, including building security plans and employee Social Security numbers.
  • This is the latest in a pattern of similar audit findings dating back to 2014, indicating systemic and unresolved failures.
  • GSA lacks basic security practices: no approval process for sensitive data sharing, no naming conventions for sensitive files, and fails to properly manage its data-loss prevention tool.
some voices

Cloud storage is only as secure as the least careful person with access to it.

  • “CloudStorage : as safe as the most ignorant person in any given workforce.”

    Doug_Bostrom@scicomm.xyz · Mastodon ↗

“describes the building's collapse vulnerabilities, defense vulnerabilities, and critical failure locations”

GSA Office of Inspector General · The Register ↗

General Services Administration (GSA) Federal agency subject of auditGSA Office of Inspector General Internal audit authority

GSA audit finds 116 sensitive files improperly shared on Google Drive
theregister.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 2 pieces in 3h at Oct 29, 11 AM; 4 pieces over 13 days (3 articles · 1 post) Oct 29, 11 AM — 2 pieces · 2 articles — Newswires 2Oct 29, 2 PM — 1 piece · 1 article — Newswires 1Oct 29, 5 PM — 1 piece · 1 post — Mastodon 1Oct 29, 8 PM — quietOct 29, 11 PM — quietOct 30, 2 AM — quietOct 30, 5 AM — quietOct 30, 8 AM — quietOct 30, 11 AM — quietOct 30, 2 PM — quietOct 30, 5 PM — quietOct 30, 8 PM — quietOct 30, 11 PM — quietOct 31, 2 AM — quietOct 31, 5 AM — quietOct 31, 8 AM — quietOct 31, 11 AM — quietOct 31, 2 PM — quietOct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — quietNov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — quietNov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quietToday, 1 AM — quietToday, 4 AM — quietToday, 7 AM — quietToday, 10 AM — quietToday, 1 PM — quietToday, 4 PM — quietToday, 7 PM — quiet 1
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 8:49 PM ET
  1. 1

    OIG identifies systemic management failures enabling the exposure

    The inspector general found GSA lacks an approval process for sharing sensitive information and a standard naming convention to prevent CUI exposures. The agency is mismanaging its data-loss prevention tool: annual reviews are incomplete or undocumented, relevant search terms are not implemented, optical character recognition is not enabled, and GSA was unaware the tool has a 15-megabyte file size limitation.

    “We also found that GSA lacks: (1) an approval process for properly sharing sensitive information and (2) a standard naming convention that could more effectively prevent exposures of CUI in GSA's Google Drive.”
    — GSA Office of Inspector General
    • Doug_Bostrom@scicomm.xyz

      # CloudStorage : as safe as the most ignorant person in any given workforce. https://www. theregister.com/public-sector/ 2026/10/29/gsa-left-sensitive-google-drive-files-open-to-staff-contractors/5306430

      Doug_Bostrom@scicomm.xyzMastodon13d agoview on Mastodon ↗
  2. background

    Audit reveals exposed security plans, employee records, and vendor data — The OIG report details the types of sensitive information found exposed on the shared drive: DC building site plans with entrances, screening techniques, and gun locker locations; progressive collapse analyses describing building vulnerabilities; employee PII including Social Security numbers, addresses, and birth dates; and proprietary vendor research and pricing information.

  3. background

    GSA OIG publishes audit of Google Drive security failures — The General Services Administration's Office of Inspector General releases a report documenting repeated inadequate protection of controlled unclassified information on the agency's Google Drive since at least 2014. A limited audit found 116 files improperly shared with all GSA users.

What people are saying 0 voices from 0 sites · best of 1 · verbatim