GAO Finds Treasury's Fiscal Service Did Not Fully Implement Security Controls Over DOGE Payment-System Access, and a DOGE Employee Sent Unencrypted PII Outside the Bureau
The Government Accountability Office reported on Treasury DOGE team access to the Bureau of the Fiscal Service payment systems. The bureau fully implemented five of the 14 selected controls GAO tested for making sure DOGE team employees followed its IT security rules. GAO also found that a Treasury DOGE employee “did not encrypt PII sent to another agency or obtain approval for sharing this information prior to sending it”.
Follow-up. “As of September 2026, BFS has not implemented the recommendations.”
Ledger class. FOUND (GAO audit). The yardstick is federal IT-security and privacy controls, not a legal holding under the Privacy Act.
Sources & Citations
[1]
GAO-26-108131, Department of Government Efficiency: Treasury Needs to Fully Implement Data Protection Controls
— U.S. Government Accountability Office (Wayback copy; gao.gov returns 403 to scripted fetches)
· Apr 28, 2026
Tier 1
[2]
GAO-26-108192, DOGE: Congress and the Public Lack Assurance That Systems and Data Were Protected at Multiple Agencies
— U.S. Government Accountability Office (Wayback copy)
· Sep 29, 2026
Tier 1
Tiers
Tier 1 court records & gov docs ·
Tier 2 established outlets ·
Tier 3 regional & specialty press ·
Tier 4 opinion or single-source.
Methodology →
Cite this entry
The Cascade Ledger. “GAO Finds Treasury's Fiscal Service Did Not Fully Implement Security Controls Over DOGE Payment-System Access, and a DOGE Employee Sent Unencrypted PII Outside the Bureau.” The Capture Cascade Timeline, April 28, 2026. https://capturecascade.org/event/2026-04-28--gao-finds-treasury-bfs-did-not-fully-implement-controls-over-doge-access/