A Whistleblower Takes on DOGE

Summary

Podcast Summary: "A Whistleblower Takes on DOGE"
Up First from NPR
Release Date: April 27, 2025

---

Introduction

In the April 27, 2025 episode of NPR's Up First, the focus is on a groundbreaking story uncovered by NPR reporter Jenna McLaughlin. The episode delves into the revelations of Daniel Baroulis, a whistleblower from within the federal government, who exposes concerning activities of the Department of Government Efficiency (DOGE) at the National Labor Relations Board (NLRB). Hosted by Ayesha Rascoe, along with contributions from Jenna McLaughlin and Stephen Fowler, the episode provides an in-depth analysis of the potential threats to sensitive government data and the broader implications for federal cybersecurity.

---

The Whistleblower: Daniel Baroulis

Background and Motivation

Daniel Baroulis, an experienced cybersecurity specialist at the NLRB, shares his journey leading up to the whistleblowing event. He recounts a pivotal moment in February when he received an unexpected call from his boss about DOGE’s impending visit:

[00:23] Daniel Baroulis: "I remember the moment vividly. I was at home and I got a call from my boss saying, hey, my boss wants us to come in next week. It's possible DOGE will show up on Monday."

Baroulis, driven by a strong sense of public service and a desire to protect sensitive labor data, became increasingly alarmed by DOGE's actions during their visit.

Professional Background

Baroulis has a longstanding career in cybersecurity, previously working as a technical consultant specializing in auditing corporate systems. His role at the NLRB involves securing cloud-based systems, managing access controls, and safeguarding against potential cyber threats.

---

DOGE's Access and Red Flags

Unusual Access Protocols

During DOGE’s visit to the NLRB, Baroulis observed several irregularities that raised immediate concerns:

[04:49] Daniel Baroulis: "The instructions given were very specific, and that was do not log the accounts, don't log the access, and stay out of our way."
[05:49] Daniel Baroulis: "Global admin account and not log or not track their activities or access. That's keys to the kingdom. I'm going to close my eyes now and trust you. That's something that you just don't do."

Baroulis noted that DOGE staffers were instructed to avoid logging their activities, a highly unusual request for legitimate operations. Experts interviewed by NPR corroborated that such an omission in logging is a significant security violation, typically indicative of malicious intent or an attempt to conceal unauthorized actions.

Suspicious Activities and Data Extraction

Baroulis identified further concerning activities, including the use of containers to execute and delete code without leaving traces:

[16:18] Aisha Roscoe: "And the thing that was really important to Baroulis is he saw this giant spike of data leaving the agency. That was one of the biggest red flags that he saw."
[16:41] Daniel Baroulis: "I saw that there was a good 10 gigabyte spike within the manner of maybe two hours that lined up Right about the time that they had their access accounts, it would represent data that was being copied from within our system to outside of our system."

Baroulis captured evidence of a significant data exfiltration event, where approximately 10 gigabytes of data were transferred out of the NLRB’s systems within a short timeframe. This data included highly sensitive information related to ongoing labor disputes, union members, and corporate investigations.

---

Potential Risks and Implications

Threats to Sensitive Data

The unauthorized access and potential data breach pose severe risks:

• Privacy Violations: Personal information about union members, employees, and ongoing cases could be exposed, leading to harassment or retaliation.
• Chilling Effect on Union Activities: Fear of data leaks may deter individuals from organizing or participating in union activities.
• Corporate Espionage: Companies under investigation by the NLRB might gain unfair advantages if sensitive case information is leaked.
• National Security Concerns: Combining the leaked data with other sources could allow adversaries to build detailed dossiers on American citizens.

Expert Insights

Stephen Fowler emphasizes the historical context of the Privacy Act of 1974, which was designed to prevent unauthorized access to personal data by government entities:

[06:50] Stephen Fowler: "Congress decided 50 years ago that there shouldn't be this so called God mode in government... there is so much that we entrust to the federal government... now there are people affiliated with DOGE that have access to that information..."

This unauthorized access undermines decades-old safeguards intended to protect citizens' privacy and data integrity.

---

Responses and Repercussions

NLRB and Government Reactions

The NLRB has officially denied any authorized access by DOGE:

[06:37] Jenna McLaughlin: "...the NLRB told NPR that they had no official record of DOGE visiting, that they'd never authorized DOGE accessing their systems..."

Despite these denials, forensic evidence and internal communications suggest otherwise, indicating potential internal complicity or oversight failures.

Surveillance and Threats Against Baroulis

In retaliation for his whistleblowing, Baroulis received a threatening letter at his home:

[20:20] Aisha Roscoe: "...he found a printed letter in an envelope taped to his door at home, a place he had only been living for two months. And that included a ton of sensitive personal information."

This act of intimidation not only endangers Baroulis but also highlights the risks faced by whistleblowers within the federal government.

Broader Governmental Impact

Stephen Fowler highlights that DOGE's activities are not isolated to the NLRB. Multiple federal court cases reveal DOGE's extensive access across various agencies, raising alarms about potential data misuse on a national scale.

---

Ongoing Investigations and Future Implications

Calls for Accountability

Top Democrat Gerry Connolly of the House Oversight Committee is advocating for a comprehensive investigation into DOGE’s activities at the NLRB to ensure accountability and transparency.

Whistleblower Support and Future Reporting

Baroulis remains employed at the NLRB and continues to advocate for systemic changes to protect sensitive data and support whistleblowers. NPR reporters Jenna McLaughlin and Stephen Fowler indicate ongoing efforts to track and expose further activities of DOGE across federal agencies.

[32:35] Stephen Fowler: "There are still so many questions unanswered... this is a full court press from this team and from the entire NPR newsroom."

Public and Expert Reactions

Cybersecurity experts warn of the broader implications of DOGE's unchecked access, suggesting that without stringent oversight, the integrity of federal data and national security could be compromised. The episode underscores the necessity for robust cybersecurity measures and the protection of whistleblowers to maintain governmental accountability.

---

Conclusion

The episode "A Whistleblower Takes on DOGE" sheds light on significant vulnerabilities within federal agencies, exemplified by DOGE’s unauthorized access to the NLRB’s systems. Through Daniel Baroulis’s courageous actions and NPR’s meticulous reporting, the public gains insight into the potential threats posed by inadequate oversight of government efficiency departments. As investigations continue, the story serves as a crucial reminder of the importance of safeguarding sensitive data and supporting those who come forward to expose governmental malfeasance.

---

Notable Quotes:

• [00:23] Daniel Baroulis: "I remember the moment vividly..."
• [05:49] Daniel Baroulis: "Global admin account and not log or not track their activities or access..."
• [06:50] Stephen Fowler: "Congress decided 50 years ago that there shouldn't be this so called God mode in government..."
• [20:20] Aisha Roscoe: "It's terrifying. Honestly. He doesn't know..."
• [32:35] Stephen Fowler: "There are still so many questions unanswered..."

---

For More Information:
To stay updated on this developing story and NPR’s investigative reporting, visit [e-mail].

Transcript

[Aisha Roscoe]

Aisha.

[Jenna McLaughlin]

I'm Aisha Rascoe, and this is the Sunday Story from Up First. And today we've got a big one. Recently, NPR reporter Jenna McLaughlin broke open a huge story about a whistleblower from inside the federal government. His name is Daniel Baroulis, and for him, it all started on a Friday at the end of February.

[Daniel Baroulis]

I remember the moment vividly. I was at home and I got a call from my boss saying, hey, my boss wants us to come in next week. It's possible Doge will show up on Monday.

[Jenna McLaughlin]

He sees a black SUV with a police escort pull into the parking garage at their office in D.C. daniel didn't speak to anyone in the SUV, but he assumes it was members of the Department of Government Efficiency, or doge. He'd been hearing about Doge showing up with police escorts around town, and based on that call with his boss, he was expecting them to arrive that day.

[Daniel Baroulis]

They didn't want to interface with us, the admins. They wanted system access to the cloud. That's what they were there for, and.

[Jenna McLaughlin]

Access to the cloud they got. This is Baroulis's whole job, to guard the sensitive data in the cloud of his agency. He works at the National Labor Relations Board, or nlrb, which is a small, independent federal agency that enforces the law to protect people from unfair labor practices. Like when a corporation wants to illegally punish workers for organizing a union. After the DOGE team arrived, Barula saw one red flag after another indicating that sensitive data at the NLRB was at risk. It scared him enough to come forward as a whistleblower. He filed a disclosure with Congress, and he approached Jenna at npr. Baroula's story gives us a rare look at what Doge was doing inside this agency and perhaps inside many others, and also what that means for the sensitive data of millions of Americans. Jenna McLaughlin has covered cybersecurity for over a decade. Stephen Fowler is also with us. He's been focusing on the big picture of the federal government's restructuring under President Trump. Jenna and Steven, thanks so much for being here.

[Stephen Fowler]

Thank you.

[Aisha Roscoe]

Thanks for having us.

[Jenna McLaughlin]

So tell me a bit about this particular whistleblower at the nlrb. Like, who is he?

[Aisha Roscoe]

Yeah, I was lucky enough to speak to Baroulis at length. You even got notes.

[Daniel Baroulis]

I have my timeline, my handwritten. So let me get that out before.

[Aisha Roscoe]

We get started and got to learn a lot more about him and what makes him tick. Let's just start off with you introducing yourself, telling me a little bit about you.

[Daniel Baroulis]

So my name is Daniel.

[Aisha Roscoe]

When he was 16. He got a computer for his birthday instead of a car. And he just took it apart to see how it worked and put it back together.

[Daniel Baroulis]

I fell in love. I found the first video game I could play and it broke. And then I fixed it by just learning every little bit about how the hardware works and what parts are broken and what's doing what.

[Aisha Roscoe]

He did the same thing with electronics from the thrift store, actually. He would buy radios and take them apart. He even said that he once got nearly electrocuted messing around with all the electronics.

[Daniel Baroulis]

My pastime is I like to understand how things work.

[Aisha Roscoe]

And he's worked in this field for many years. Prior to being in the government, he was a technical consultant. He was a specialist actually doing auditing of corporate systems. So exactly the kind of stuff that Doge says that they're trying to do. That was actually Brulis's job. He says he decided to join the NLRB because he was really interested in public service. He had done volunteer firefighting in the past. He had worked for a rape crisis line, but he wanted to use his technical skills to do more.

[Daniel Baroulis]

The agency that I work at, they have a very specific mission. They are really the voice of the downtrodden and unincorporated worker when they try to make working conditions better for themselves or their coworkers and management comes in and punishes them or fires them, that's where the NLRB steps in.

[Aisha Roscoe]

So his job at the NLRB specifically is to secure the cloud based systems. He reinforces who gets access to those systems and he helps keep out attackers.

[Jenna McLaughlin]

So Daniel Baroulas has been working in cybersecurity for a long time. Walk me through what he saw when the Doge team accessed the NLRB systems.

[Aisha Roscoe]

So normally anyone working on these systems, once they create an account, there's a ticket filed. You get to track a little bit about what that account is doing. But when the Doge staffers came in, Baroula said that his colleagues were asked not to track anything, to just completely act like they were never there.

[Daniel Baroulis]

The instructions given were very specific, and that was do not log the accounts, don't log the access, and stay out of our way.

[Jenna McLaughlin]

How unusual is that request not to log? Like, does that happen often or are there special situations where they don't log?

[Aisha Roscoe]

It's really unusual. Every expert I talked to for this story, over 10 people, said there's absolutely no reason that you wouldn't want your activity logged if you're doing something legitimate, because at the bare minimum, it allows you to troubleshoot to fix errors that are completely benign. If there is a potential breach or a concern about a cybersecurity issue, it gives you a lot of clues about what systems affected, what happened, which users were involved. So, yeah, it's extremely problematic. And it really set off some red flags for Baroulis to give somebody a.

[Daniel Baroulis]

Global admin account and not log or not track their activities or access. That's keys to the kingdom. I'm going to close my eyes now and trust you. That's something that you just don't do. It violates every core concept of security and best practice.

[Aisha Roscoe]

It's important to say when we asked NLRB for comment on this story, they said they had no official record of Doge visiting, that they'd never authorized Doge accessing their systems, that DOGE had never requested access. Of course, that's counter to Baroulis official disclosure, plus records of internal communication seen by NPR and the forensic evidence that we've been looking at. It's really possible that this first visit and this request not to log access was outside senior leadership's awareness that they didn't know about it.

[Jenna McLaughlin]

Stephen, kind of help us zoom out a bit and put all of this into context. How is this different from how the federal government has historically operated?

[Stephen Fowler]

So the big thing I want to talk about here is the Privacy Act. It was passed in 1974, and that's a lot of the backbone of these lawsuits challenging Doge's access. Congress decided 50 years ago that there shouldn't be this so called God mode in government, and there shouldn't be the ability for one person or a small group of people to be able to access virtually anything and everything about somebody that the federal government keeps. I mean, there's Social Security numbers, employment information, you've got immigration information, bank accounts. The thing I want people to realize about this is that there is so much that we entrust to the federal government and federal agency data wise that individually doesn't say that much. But now there are people affiliated with DOGE that have access to that information and also have access to the Social Security Administration and your Social Security number and any statements and benefits. And so even if they don't use it that way, we are now at a point where a small handful of people could build dossiers on people and do who knows what with it. And that's something that has concerned people across the ideological spectrum who are very much worried about privacy.

[Jenna McLaughlin]

And so Doge is now inside the NLRB working without much oversight. What happens next?

[Aisha Roscoe]

Yeah, Aisha, So for the first couple of days, Baroulis was continuing to do his job as normal. He went home on the weekend, and then he noticed that this political reporter, Roger Sullenberger, tweeted about one of the Doge engineers and his public Git Hub page. So basically, that's a place where you can host coding projects, collaborate with other people on that project. And he noticed that a project was deleted or made private before he was able to figure out what it was. But the name was really interesting. The name of that project was nxgen. B Door Extract. Nxgen is the name of an internal system that was designed specifically for the NLRB in house, built just for them. And because of that name, Baroulis was freaked out.

[Jenna McLaughlin]

What is this file like? What is he looking at?

[Aisha Roscoe]

Yeah, every single person I talked to about this immediately just gasped. They were shocked that someone would actually call something this. Because the name B Door essentially implies that you're building a backdoor or a way to get into a system that's not authorized, a possible way to extract information.

[Daniel Baroulis]

When I saw this tool, I immediately panicked. Just for lack of a better term. I kind of had a conniption and said, whoa, whoa, whoa.

[Aisha Roscoe]

So, to be clear, we were not able to recover the code for that project. We can't know exactly what the program was doing without seeing the details of that code. But even without knowing when it was created or how frequently it was used, the real importance of this is that it made Brulis concerned. That's when his real fears started to escalate.

[Jenna McLaughlin]

And why did that scare him so much?

[Aisha Roscoe]

Mostly because he was really scared of the data inside the NLRB getting out, particularly the data that lives in an extremely sensitive internal system, the case management system. That's where all the case files live of ongoing NLRB investigations. So, Aisha, here's some of the kind of data that NLRB has. Personal information about union members or employees that are voting to join the union. It has witness testimony in ongoing cases. It lists union organizers and leadership. And, you know, even if there's a possibility that that information was out in the wrong hands, we spoke to a lot of labor law experts who said that it could have a chilling effect. It could scare people from forming unions or coming to the NLRB with concerns or testifying if they feel like that information isn't going to be secure. But, you know, even if you're not the biggest fan of unions, this agency also has sensitive business information. Companies sometimes cooperate with investigations, whether it's an investigation into potential trade secrets or something along those lines. So it's possible that companies will have shared a lot of information about their internal workings that they also would not want exposed.

[Jenna McLaughlin]

So help me understand what's really at stake here. Like, what really could come out of this data?

[Aisha Roscoe]

I think, firstly, if someone had this data, they could use it to create blacklists of union organizers, fire a bunch of people, target harassment, intimidation tactics at individuals involved in union activism. It could even give a company an advantage in an ongoing legal battle with the nlrb. If you've got insight into the opposing counsel's notes, you can probably come up with a pretty good response. Meanwhile, a foreign adversary or criminal hacker might be really interested in that data, too. They might hold it for ransom. They might learn more about their competitors, businesses or innovations. And it's also possible that this data could be combined with some of the other sensitive sources of data that Stephen's been talking about to build a larger dossier on American citizens.

[Jenna McLaughlin]

Stephen, you've been covering DOGE at large. Like, how does this complaint from this whistleblower fit into the larger story of what DOGE as advisors, are doing across the federal government?

[Stephen Fowler]

So the National Labor Relations Board is just a small pocket inside the federal government, but we have some of the most detailed looks at what DOGE is doing and how they're doing it because of this whistleblower and also because of more than a dozen lawsuits. These are federal court cases that I'm tracking and a handful of agencies challenging how DOGE has access to the sensitive data there and the fact that they even have access to the data at all. Individually, these cases paint isolated pictures about Employee 1 having access to Database 1 here, and so on and so forth. But we pulled all of these things together and found this pattern of a small number of DOGE staffers being given access to virtually everything at all of these agencies that control just vast amount of data about millions and millions and millions of Americans.

[Jenna McLaughlin]

When we come back, the whistleblower himself becomes the target of secret surveillance and threats.

[NPR Sponsor]

This message comes from NPR sponsor Amazon Prime Video presenting Common Ground, a film about the power of agriculture to reshape the planet through sustainable farming. Featuring Jason Momoa, Laura Dern, Donald Glover, Rosario Dawson and Ian Somerhalder. Common Ground profiles a movement of farmers using regenerative models of agriculture that could balance the climate, save people's health and stabilize America's economy. Now streaming only on Prime.

This message comes from Schwab at Schwab. How you invest is your choice, not theirs. That's why when it comes to managing your wealth, Schwab gives you more choices. You can invest and trade on your own. Plus get advice and more comprehensive wealth solutions to help meet your unique needs. With award winning service, low costs and transparent advice, you can manage your wealth your way at Schwab. Visit schwab.com to learn more. Support for this podcast and the following message come from Mint Mobile Mint Mobile and their Premium Wireless Plans start at just 15 bucks a month say goodbye to overpriced wireless plans. Get three months of premium wireless from Mint Mobile for 15 bucks a month. Shop data [e-mail] NPR upfront payment of $45 for three month five gigabyte plan required. New customer offer for first three months only, then full price plan options available, taxes and fees extra. See Mint Mobile for details.

[Jenna McLaughlin]

We're back with Jenna McLaughlin and Stephen Fowler. So about a week after they arrived, the Doge engineers left the NLRB systems and deleted their accounts. But Baroulas kept looking into their activity and he uncovered other clues that made him alarmed. Like what else did he discover?

[Aisha Roscoe]

Yeah, there was some really weird stuff going on that any IT specialist that you talk to is going to kind of scratch their head about. He saw them using what's called a container. It's kind of like a little bubble that exists inside of a computer where everything that you're doing inside of it is invisible to the rest of the system. So you can execute code, you can have it run a bunch of automated programs, and then when it's deleted, when you're done with it, nobody really knows it was ever there or what it was up to. In his disclosure to Congress, Baroulis also said that they turned off Multi Factor authentication, deleted logs, turned off security requirements for mobile access. You know, these are all security controls that would be really strange and unusual for a regular user to disable. And you know, for Baroulas, all of this points to a real attempt to obfuscate activities to cover tracks.

[Daniel Baroulis]

From what I saw, these tools have a very specific use, what you would call part of a hacker toolkit.

[Aisha Roscoe]

And then the thing that was really important to Baroulas is he saw this giant spike of data leaving the agency. That was one of the biggest red flags that he saw. He captured images of data transiting out of the agency over time, over several weeks. And there's one gigantic spike that you can see right in the time where Doge had access.

[Daniel Baroulis]

I saw that there was a good 10 gigabyte spike within the manner of maybe two hours that lined up Right about the time that they had their access accounts, it would represent data that was being copied from within our system to outside of our system. And for it to spike like that, that's across the board, probably the number one indicator that you've been breached.

[Aisha Roscoe]

So first Baroula saw files leaving the case management system that we had been talking about. He described it as kind of the nucleus, where all the sensitive stu lives and stuff never leaves there. And then he saw a slightly larger chunk of files leaving the entire system, and it was impossible to know exactly what those files were. It's all extremely mysterious and sketchy, but.

[Jenna McLaughlin]

But has NPR seen evidence of this? You know, is he just making allegations or have people confirmed, like what he says he saw?

[Aisha Roscoe]

Luckily, Baroulis came with the receipts he included in his official disclosure that same image I had been talking about, where it shows the spike of data leaving the system. So he was able to definitively prove that data left that should not have.

[Jenna McLaughlin]

And what makes him think that Doge may have taken this data?

[Aisha Roscoe]

He really double and triple checked his work. He stress tested these theories. So he talked to all of his colleagues.

[Daniel Baroulis]

I went to, you know, obviously immediately try to validate that this was not legitimate copying. And so first went to the dev team, validated that nobody was working on the systems at that time. It was like an early morning. So what did make sense for them anyway?

[Aisha Roscoe]

He confirmed no one at the NLRB had been saving backup files that week or migrating data for projects. And, you know, the timeline matched up. He essentially thought of it as, you know, even if Doge was not the one responsible for this, something unusual happened and it needs to be investigated. I spoke to Richard Griffin. He was the former NLRB general counsel from 2013 to 2017, and he told me in an interview that none of that confidential and deliberative information should ever leave the agency.

[Jenna McLaughlin]

So how much data are we talking about? Like, is it every file that the NLRB got?

[Aisha Roscoe]

So it's not everything. The data leaving was almost all text files. It added up to around 10 gigabytes. Think of that like the equivalent of a full stack of encyclopedias worth of pages if someone printed them. But it's possible the files that were extracted were compressed into a smaller package or that only some of the files were extracted. They could have searched for something specific.

[Jenna McLaughlin]

When he realized this data was taken, what did Baroulis do next?

[Aisha Roscoe]

Well, according to his disclosure, next thing he does is gather the troops. He got his IT team together to discuss possible insider threats, namely the Doge Engineers. So this group of people eventually launched a formal breach investigation. They were actually preparing a request for assistance outside their agency from the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency. That's a mouthful. You can just call them cisa. They have more forensic tools to investigate potential breaches than the NLRB does. But ultimately those efforts kind of just went quiet. They were disrupted without an explanation from somewhere higher up, according to Brulous instructions.

[Daniel Baroulis]

To drop it, to not file the report. It was one of those situations where it just. It bothered everybody that was involved in my agency and my, especially my department to do that. And so there was a lot of concern amongst us about that.

[Aisha Roscoe]

So, Aisha, I should also say that the NLRB told NPR that they did conduct an investigation into Brule's claims. They said that they ruled out a breach. However, given the evidence in Brulis's disclosure that NPR reviewed, he argues that there's suspicious activity that should be investigated further. In the days after requesting the formal investigation, it got even scarier. Baroulis actually found a printed letter in an envelope taped to his door at home, a place he had only been living for two months. And that included a ton of sensitive personal information. It had photos of him walking his dog that appeared to be taken with a drone. And, you know, when investigators and myself tried to follow this data trail and figure out where this could have come from, we could not find it, even in the tools that journalists have access to to search through public records.

[Jenna McLaughlin]

That's really scary. I mean, the idea of it seems like someone's watching him. Does he know or have any idea who left that letter?

[Aisha Roscoe]

It's terrifying. Honestly. He doesn't know. Law enforcement is investigating as we speak right now. There's not clear obvious suspects yet, but he's really scared because all of this really sensitive data, it was only available in his government file. He only recently updated. He just moved like two months ago.

[Jenna McLaughlin]

When we come back from the break, Jenna and Steven consider what else could be motivating DOGE to access all this data.

[NPR Sponsor]

This message comes from the Nature Conservancy. Working together to create a future with a livable climate, healthy communities, and thriving nature. Explore ways to act during Earth Month and every [e-mail] NPR. This message comes from NPR sponsor Dana Farber Cancer Institute. Breast cancer cells multiply faster because of CDK4.6 proteins. But what if blocking those proteins and stopping runaway cell division was possible? Dana Farber Scientists laid the foundation for CDK4.6 inhibitors, new drugs that are increasing the survival rate for many advanced breast cancers. Dana Farber's momentum of discovery keeps finding new ways to outmaneuver cancer. [e-mail] Everywhere this message comes from NPR.

Sponsor Tools and Weapons, the podcast hosted by Microsoft's Vice Chair and President Brad Smith. Across three exclusive conversations on the company's 50th anniversary, Microsoft's CEOs Bill Gates, Steve Ballmer and Satya Nadella share the stories, dreams and drive that fueled the digital revolution and explain why it may be at its most exciting point yet for these and more conversations with other thought leaders. Search tools and Weapons Wherever you listen.

To podcasts, this message comes from Thuma Create your oasis with Thuma, a modern design company that specializes in furniture and home goods, by stripping away everything but the essential. Thuma makes elevated beds with premium materials and intentional details with clean lines, subtle curves and minimalist style. The Thuma Bed Collection is available in four signature finishes to match any design aesthetic. To get $100 towards your first bed purchase, go to T H U M A CO NPR.

[Jenna McLaughlin]

We'Re back with the Sunday Story. From up first, we're talking with reporters Jenna McLaughlin and Stephen Fowler about a huge story that they've broken wide open after talking to a whistleblower at the National Labor Relations Board, or nlrb. So what are the consequences of the access that DOGE has gained to these systems? What kind of vulnerabilities has DOGE left in its wake?

[Aisha Roscoe]

So Baroulis can't confirm for sure, but he has reason to believe that there was potential malicious activity. According to his disclosure, there were multiple login attempts to the system from a Russian IP address that was using the new credentials that DOGE appears to have created. So, Aisha, this happened within minutes of those new accounts being created. Because of all this, experts told me that they could see the possibility that DOGE has been compromised. I spoke to Russ Handorf. He's a former FBI cyber expert. He said malicious cyber actors, whether they're criminals or hackers working for Russia and China, might be really interested in getting inside the NLRB systems. And that's for a couple of reasons. First, we've heard US Government officials sounding the alarm for years about stealing US Intellectual property to benefit their own industries and companies. It might also be valuable for blackmail purposes or to hold the data for ransom. But the thing about this is this cloud account could be connected to other government systems, and Handorf said that it could be a way for a hacker to jump off from NLRB and go somewhere else.

[Jenna McLaughlin]

Stephen you mentioned earlier that there's no reason Doge needs to access the data at the NLRB for their stated mission, which is to deal with waste, fraud and abuse. So why else might they want to collect it?

[Stephen Fowler]

Yeah, it is worth mentioning that at a lot of these agencies that Doge has had access to data, there is a benefit of the doubt to understand why they would have it. For example, you know, at the Social Security Administration, they are looking at data to try to find evidence of people receiving benefits that they shouldn't have. This is nowhere like that. It could be used for business purposes, especially if you're Elon Musk. His companies have several active cases before the NLRB. There's a group of former SpaceX employees that have lodged a complaint against Musk as an example. And Musk and SpaceX are part of a group of companies that have filed suit saying that the NLRB itself is unconscious, constitutional. So, in theory, if this data was taken by somebody affiliated with Doge and given it to Elon Musk, he could have access to sensitive information about these cases that have been filed against his companies, used to target lawyers or witnesses or other people involved with the case. Also, it's stuff about his competitors. I mean, there are multiple competitors that also have cases before the NLRB and also have trade secrets or other intercompany workings that are involved here. Another thing I want people to think about is the potential for data scraping. There's been a lot of reporting across the government about Musk and Doge and the use of artificial intelligence programs. You know, things like XAI and grok, that are being used to basically train on government data for things.

[Jenna McLaughlin]

So, Stephen, from what you're saying, it's like this story is likely bigger than just the nlrb. Um, since Doge has gained access to several agencies at this point, how have cybersecurity experts at other agencies responded?

[Stephen Fowler]

Well, we have seen testimony in those federal court cases that I was talking about of people expressing alarm about how Doge had access to the data. But at the same time, there isn't really much of a response because many of these cybersecurity professionals have resigned, been forced out, relocated, put on administrative leave, taken the buyouts that have been offered. So it's really hamstrung the ability to respond to or keep track of what Doge is doing. I'm thinking specifically of Erie Meyer, a technologist who stepped down after Doge did something similar at the Consumer Financial Protection Bureau. Jenna talked to her for this story. She said, I'm trembling. They can get every piece of whistleblower testimony, every report, everything. This is not good. Another employee at the Department of Interior sub agency who requested anonymity fearing retribution, said their cyber teams are, quote, pissed because they have to sit on their hands when every single alarm system we have regarding insider threats is going off.

[Jenna McLaughlin]

That's a lot of red flags. How has the administration reacted?

[Stephen Fowler]

Trump issued an executive order that asked federal agencies to find ways to break down information silos and share non classified data more easily across the federal agencies and to do so as applicable by law. But as we've seen here, their interpretation of what the law is is different from some of these experts.

[Aisha Roscoe]

And Ayesha, the White House gave us a comment after we published. They said essentially it's old news that Doges and federal agencies like the NLRB sharing data. They did not deny it.

[Jenna McLaughlin]

So what else has happened since you broke the story last week?

[Stephen Fowler]

Well, the top Democrat on the House Oversight Committee, ranking member Gerry Connolly of Virginia, is calling for an investigation into Doge's access to the NLRB to get some answers.

[Aisha Roscoe]

Meanwhile, we got a copy of an email informing NLRB employees that two Doge staffers will embed with the NLRB for the next two months. You know, given the fact that folks like Connolly want independent investigations, it'll be hard to guarantee that those new Doge staffers aren't going to mess with any forensic evidence while they're there. We're also hearing some IT staff have been locked out of the systems that they work on. Basically they can't see what's going on or do their job with all of this.

[Jenna McLaughlin]

I'm still thinking about the whistleblower Baroulis and the picture of him walking his dog and all of that. Across administrations, we have seen that being a whistleblower can be dangerous. Is Baroulis still at the NLRB now?

[Aisha Roscoe]

Baroulas is still employed at the NLRB and we haven't heard any indication that he's going to be put on administrative leave or fired. In their statement, NLRB told us that they're committed to protecting their employees rights to make official disclosures to Congress and that they will cooperate with any investigation. But I think you're right, it's a really scary moment right now. And for him to know that these Doge staffers might be in the office with him after he raised these concerns, it's really troubling. But Brulous felt like it was really important to do this. He said it was a moral imperative that he has never encountered something like this in his 20 years of it.

[Daniel Baroulis]

I wouldn't be able to live with myself otherwise. To know that this data was out there, it's going to impact these cases. It's going to cost people their real livelihoods. And for that to happen with nobody knowing what happened, that's the biggest travesty of all. And I believe with all my heart that this goes far beyond just case data. I know that there are other admins at other agencies I've spoken to who have seen similar behavior, and they are uncomfortable speaking up, they're uncomfortable reporting it, because at the end of the day, they have families, they have things on the line that have been implicitly threatened. Standing up like this. I'm not hopeful for the outcome. For me, what I am hopeful is that people look and say, hey, somebody else did it. I can do it too. And if enough people stand up, it can form a movement. And these practices that they're breaking security and violating and stealing data without anyone knowing, it can be stopped.

[Aisha Roscoe]

And he actually made a personal plea to the Doge engineers. It was a simple request.

[Daniel Baroulis]

Be transparent. If you have nothing to hide, don't delete logs. Don't be covert about your entrance to agencies. Be open, because that's what efficiency is really about. If this is all huge misunderstanding, then just prove it. Put it out there. That's all I'm asking.

[Jenna McLaughlin]

Stephen, you mentioned that you and Jenna are part of a team investigating the restructuring of America's federal government. What's your team doing now, and how are you continuing to uncover Doge's activities?

[Stephen Fowler]

Well, there are still so many questions unanswered, both with this specific story and with other impacts across the federal government. So we are fanning out across the country across federal agencies, tracking these changes, trying to understand how things are changing for the worse, for the better, or not at all. And, you know, there's these dozen court cases that are ongoing that there are just going to be more and more developments. So this is a full court press from this team and from the entire NPR newsroom.

[Aisha Roscoe]

Absolutely. And meanwhile, Aisha, we're already hearing from more federal workers after this story came out. They wanna share more about what they're seeing at their agencies. So our team has a lot of work to do.

[Jenna McLaughlin]

So if somebody is listening and they wanna share some important information with you, where can they reach either of you?

[Aisha Roscoe]

So the place to go is Signal, the encrypted messaging application. Signal is a great tool. You know, it does a really good job of protecting the average user. It's not totally bulletproof if you're using a work device or if the phone itself is compromised. But for the average person, it does a really good job of keeping your data safe. And, you know, just a note for full disclosure, NPR's CEO Catherine Marr is chair of the board of Signal. To find us on Signal, click the little pen and pad in the top right corner of the app and search for our usernames. Mine's Jenna McLaughlin, 54 and Stephen Mine.

[Stephen Fowler]

Is my name without vowels. S, T, P, H, N, F, W, L, R25. Both of those are also at the bottom of our stories about this.

[Jenna McLaughlin]

Jenna and Stephen, thank you so much for all of this incredible reporting on the changes happening in our government.

[Stephen Fowler]

Thank you.

[Aisha Roscoe]

Thanks for having us.

[Jenna McLaughlin]

That's NPR's Jenna McLaughlin and Stephen Fowler. You can find more details of their reporting on the [e-mail] this episode of the Sunday Story was produced by Kim Naderfehn Petersa and Andrew Mambo. It was edited by Liana Simstrom, Irene Noguchi and Brett Neely. The mix engineer for this episode was Jimmy Keeley. The Sunday Story team includes Justine Yan and Jenny Schmidt. We always love hearing from you, so feel free to reach out to [e-mail] I'm Aisha Roscoe. Up first is Back in your feed tomorrow with all the news you need to start your week. Until then, have a great rest of your weekend.

[NPR Sponsor]

This message comes from Warby Parker. Prescription eyewear that's expertly crafted and unexpectedly affordable. Glasses designed in house from premium material starting at just $95, including prescription lenses. Stop by a Warby Parker store near you. This message comes from Bombas. Socks, underwear and T shirts are the top three requested clothing items by people experiencing homelessness. Bombas makes all three and donates one item for every item purchased. Go to bombas.com NPR and use code NPR for 20% off. This message comes from Warby Parker. What makes a great pair of glasses at Warby Parker? It's all the invisible extras without the extra cost, like free adjustments for life. Find your [e-mail] or visit one of their hundreds of stores around the country.