The entire US Social Security database was uploaded on a random cloud server, Whistle-Blower Says
https://www.nytimes.com/2025/08/26/us/politics/doge-social-security-data.html?unlocked_article_code=1.hE8.0yRw.B-PJ1MUPS4HwOpen linkView original on lemmy.world830
Comments93
Gee, who could've foreseen this happening after a gang of techbro goons forced their way in and opened backdoors on all those computers...
Forced their way in, were given the keys and explicit orders to take all the data and put it in massive back-door ridden places for themselves and Russia, potato, potahto
They (the DOGE bros, especially Elon) deserve prison time for their fuckery.
Is the answer, "what is treason"?
Baby, don't skirt it. Don't skirt it. The law.
double checks the community instance
Yes.........prison
An extremely short life sentence
Funny, I have an interview invite from DOGE (I considered joining USDS before it became DOGE, had been asked to join by a member back during Obama). Obviously I never did it, but I do keep those emails for historical purposes now haha
I don't think it was a "random" cloud server at all. I think the people who bought the data already have it now.
Half right. OP's title is massively misleading. Private SSA cloud, the complaint is about where oversight comes from.
I’ve said for a while that the SSA should do basically this exact thing. In a more controlled manner, but still the same result. Announce something like “in two years, we’ll make our database public. Every single name, DOB, and SSN will be publicly searchable.
It sounds radical, but SSNs were never meant to be a secure form of ID. Old cards even said something like “do not use this as ID” on them. But organizations quickly latched onto it because they wanted to have a way to identify individuals with the same name and DOB. And SSNs were convenient because people already had them.
It would force organizations to develop their own way to ID people. It would be a huge step towards making an actual secure form of ID. And the warning time would give people enough time to design the new system and roll it out, while still giving a hard deadline for when it needs to be done.
Exactly who I trust to create a logically organized database of all peoples within the United States. The current administration..
I don't love the idea of the Trump administration being in charge of creating a national ID system, but this maybe the best time to make one.
If Democrats proposed a national ID database the crazy 'FEMA is coming to round us up' republicans would freak out about it. As proven with Trump sending the national guard into D.C., as long as Trump does it they don't care.
I hate this is a good point
I dont have a problem with that, but what I will object to is the current regime making the replament ID system. 1) there is no way they would design it well or securely, smart people capable of building such a system are usually the first to bounce to another country as they will have the means to do so. 2) it would be too easy for them to lord the new ID over peoples heads (like they are with immigration status now) and impliment a social credit score like China does.
Your correct that SSNs should not be used as IDs, but getting the government to build a modern system for that opens too many avanues for abuse (especially with darth cheeto in charge).
this is a whole can of worms that you can look into but the entire western conception of the Chinese social credit system is essentially a myth propagated by western media outlets.
don’t get me wrong, the chinese government legislated local governors implement something vaguely similar to the financial credit system in the west but, as the law works in china, they all interpreted the order differently and it seems only the “good” parts get rolled out nationally.
situations similar to the western “social credit” myth existed for a brief time in a very small number of local pockets (think smaller divisions such as cities and towns), but they were quickly absconded and the architects of those systems punished, for essentially wasting government time and money.
note i’m definitely not a tankie fuck tankies but i also think if we’re gonna talk about china we don’t need to make shit up bc just like the US there is plenty of real shit to criticize. the “social credit” thing is a joke that westerners get made fun of internationally for believing, pretty much. it’s not remotely real, at least how you probably think of it.
realistically at this point you don’t have more or less rights or freedoms as a citizen of china or the united states. you’re pretty equally fucked either way now.
I don't know much about it, but what did they change with the whole Real ID / star on Licenses and such. I believe the purpose was to make it so the IDs were to a minimum standard so they could be accepted in all 50 states. If they all had unique ID numbers (I don't know that they do) they could have just used those, or expanded on those and already have the ID system in place. To travel to another state and have a valid ID, I believe the cut off date is November of this year. (At least for my State, because my spouse doesn't drive and her ID she was told would no longer be valid post November if she doesn't go in and get it done)
Honestly you don't need such an official system, and such a commercial system, as that network of data brokers and credit rating providers, already exists. So of that in particular I wouldn't be scared because it's not avoidable anyway. What's avoidable is government's ability to discriminate based on data. Think how.
There was a time when bank card number was practically all you needed to get someone's money.
I think Estonia's electronic IDs are the best, they have the government sign (sometimes provide, but generally just sign) your public key. It's both that the government doesn't have your private key and that it's immediately usable for many things. I don't know if they do, but one can also make ID cards (with a necessary chip inside, of course), where a private key can be written and used for signing operations, but not read back.
Modern technology allows so much goodness that politicians and corps have just started globally gaslighting us over what can be done and what can't. Stalling on technically easily solvable issues, so that it wouldn't come to real ones.
The simple act of comparing signatures meant that it was very difficult to randomly target people. We don't have anything like that today, like a key/token pair.
No, we don't need this at all. businesses need to be fined out of existence for using the ssn, and lenders should do due diligence without some imaginary score.
It could be why it's being done, because SSN are being used inappropriately. Potential leaks like this will force banks and other entities to begin making account access more difficult, and this will make it from difficult to next to impossible for a large number of seniors, those who've saved the most and have the biggest accounts, to access it. This would happen even if it was done in a two year controlled manner.
OP, please revise your title to match the article, it is currently misinformation.
The complaint is about where the oversight comes from. This is not some random cloud server.
I agree that "random server" is a bad choice of words, but do want to add additional information context as the concern isn't necessarily unwarranted. Another qoute from the article:
Its also sounds like they did spin up a new database with limited security/oversight to "move" faster. Why that's worrisome is they aren't denying there is a risk or lack of security, they are just saying it's justified.
Could you please explain like I'm 10?
The SSA stores a lot of sensitive data. Normally with sensitive data you want to be very careful with who can access it and how.
What is potentially worrisome in this situation is it seems like the SSA is taking on the "move fast and break things" attitude of Silicon Valley.
More technically, most government agencies use AWS and Azure (cloud providers) to host data. So spinning up a new server isn't inherently bad. However, creating a new server that is secure and has the correct access controls (user permissions regarding who can see/change content) can be challenging. The whistle blower believes they are not doing this right, and it sounds like the head of the SSA isn't disagreeing, just saying he thinks the risk is worth it.
That makes sense, thanks for the explanation
Oh yea, agree it's a dumb move. This should be on-prem data IMO.
BUT WONT SOMEONE THINK OF THE SENSATIONALISM?
Don't you think after 5 months without oversight who exactly has access to that server that the difference between this and a random s3 bucket is nearly nil? But you are right, in the light of integrity the title should reflect the facts as they present themselves currently.
I do, yes, it's blazingly stupid and others have been jailed for less.
But I've noticed a number of misleading post titles recently, like the just today there was obe about a cyclist getting hit by a car when it was actually the cyclist turning into traffic. Tragic, but the title misleads. So I've started pointing them out.
Maybe I just long for the days when titles aren't rewritten to drive opinion and engagement (regardless of if I agree or disagree).
Do this to everyone Trump hired or part of his cohort including him. They are all evil gangster criminals.
At this point I think you can legally opt out of any type of data collection by the government like the Census. You're required by law to participate but they are also required by law to keep your information safe, that's no longer possible in this administration and there's plenty of relevant data to back it up.
I think we should be able to have a national class action against DOGE. 100% serious, all US citizens for sure, and anyone else with data in the Social Security database, should sue the individuals responsible for this.
Then we take the money and start a company that contracts out to the government to create a national digital ID system that is the most secure in the world, and allows for amazing anonymity.
It's times like this I wonder about the like/dislike paradigm I.E. "I like/dislike knowing this and/or appreciate the perceived reputability of the source" vs. "This is good news/I fucking hate this."
This one just got a "I fucking hate this" from me.
The votes on the posting itself should reflect if the content is worth your time. I'm not even American and I have a really bad feeling after reading the article, but it's better to know than being in the dark, and the article itself is full of details which make it pretty reasonable to believe it's the truth.
Mr Borges really brought the receipts on this one, and he is one of the heros of the american people that will probably pay dearly for his courage, and he still did what's right.
More of the first, but not exactly. It's "Other people should see and know about this too" and "This isn't worth anybody's time/is factually wrong and shouldn't have been posted."
Because that's what upvoting does, makes it higher in the page so more people are able to see it.
You know, at some point you actually do something to put out the fire, you leave, or you burn.
they will have to get rid of social security now. it's the only way
"You don't have a SSN? Must be an illegal"
-ICE
SSN is a good example of the illusion of freedom for Americans, why have a standardized Photo ID when you can have a set of numbers that when leaks can ruin your life.
The whole world knows by now that these numbers are good for identifying people, and what a giant data privacy hole it is that they even exist.
So, no wonder, it had to happen sooner or later.
No, the giant problem is that you can do everything using only SSN.
We‘re getting closer to a cyberpunk world every day
Once a nuke goes off in a major city, we are pretty much guaranteed it from what I understand about multiple cyberpunk-style worlds
Good, let everything go wrong in America, they might eventually wake up and realise what a clusterfuck they've allowed themselves to become and actually do something about it.
Gee, thanks from the rest of us who already know that.
Gee, you know and are doing what about it exactly? To the rest of us looking in, it looks like you're paying lip service to it, a few demonstrations and some cardboard signs? Is that how you manage to overthrow fascism, weekend protests? good luck.
Sure is easy to spout bullshit on an internet forum. You know absolutely nothing of both what is being done here and the situation most people face.
If you have nothing productive to contribute, kindly fuck off.
I have cousins in Texas, I will kindly fuck off and live happily knowing you've bowed down and gone into the good night with a whimper. It's going to be fun to watch DC and Chicago turning into some random ME country. You have the army on the streets and you do fuck all. You have Nazi flags and call that free speech. Sad to say but you reap what you sow.
May you find the peace online you never could in real life.
I genuinely appreciate the sentiment, peace is small fleeting moments. Anger is the over riding emotion, the state of the world is cause for anger. Bless you.
They elite cackle when we do their work for them and are at each other's throats over giant generalizations online. Make them work for it. We should all offer to help each other, not whatever this thread is.
Help who? No one can help them, it's really up the americans to sort their shit out.
Help whoever you can with whatever you can. Everyone is different. My strengths and weaknesses are different than yours friend. No one person is a lost cause, and history has taught us that no one country is either.
No one person is a lost cause, and history has taught us that no one country is either. >> Agreed, but for now it's a hard transition, and hopefully this has shown that your constitution and checks and balances need to be revised in the future to prevent another authoritarian takeover.
What are you champ doing to stop genocide in Palestine?
Aren't you able to stick to the topic of the thread? There are many Palestine threads, go harass people there.
This is all on purpose. Nothing's going wrong [for them]. The well being of regular people isn't the goal.
Oh, i get that, I was talking about the people and their meek protests. The elites are laughing all the way to the bank. End stage capitalism.
Accelerationism like that never works. When it all settles, you get extremely mild improvements for a whole lot of hurt.
What do you propose then, I'm asking in good faith. It's fairly obvious to anyone with common sense that Trump, the GOP and the entire MAGA movement and their ilk need to be removed from power. How can people fight the government that is back by billionaires who control your entire lives?
Protests must be more sustained instead of the bursts of activity we've seen. Even direct action will fail if it's not combined with large scale protest methods. Unfortunately, people get worn down doing constant protesting.
Trump won't be around in another 10 years one way or another. It's rare to find cults of personality that outlive their leader. But if we use Nazi Germany as an example of what happens next, it's basically a return to liberalism. Half the country went to that almost immediately, and the other half just took longer. Granted, Germany has a better social safety net than America does now, but it's hardly anti-capitalist.
TBH, I don't have a good answer. I'm mostly doing the anarchist thing of using social groups to get people to rely less on capitalism and more on each other. That's more of a long term thing, though.
I appreciate the honest reply, I agree with most things, I think large scale protests must include a general strike. This administration is all about the bottom line, and a sustained general strike will hit them hard. I'm well aware of the argument of people living paycheck to paycheck seemingly unable to do that, however the alternative is very bleak. I wish you luck and keep it up
Just to address the idea of a general strike, you pretty much have to get sustained protests going first. More specifically, they have to encourage people from different backgrounds to work together outside of capitalist structures.
I forget the exact example, but I think it was the 1934 San Fransisco general strike. Whole city shut down, including restaurants. One problem was that there were a lot of young men who worked in the factories and lived in small apartments with no kitchens at all. They went to the general strike committee and made it known that they rely on the restaurants for their daily meals. The committee understood and had some restaurants approved for opening along with delivery trucks so they could operate. Problem solved.
Point is that you need organization around that sort of thing where even marginal groups can have their problems heard. Without getting people into organized groups, it's going to fail. If nobody listened to those young men and did something, then they would have had the choice of starving or crossing the picket line.
Those are all excellent and valid points, do you think normal thinking Americans will manage that, sustained protests followed by strike action. I completely understand the point made about the young men, the elderly and most vulnerable groups will need support. Right now all I see is some protests in some states but nothing indicates this will evolve.
Honestly, no. US infrastructure for this stuff is scaffolding, at best.
Yeah, more protests that aren't just like once a month. But I don't know how to organize that, and most of the platforms that people communicate on are owned by the worst people.
Accelerationism can work if you are in position to lead the rebellion. But for the vast majority of us, you'd be a foot soldier, probably die before ever seeing the day of victory.
"I just cloned it onto my server because my connection is not really good!"
Has this department made our government efficient yet?
Zero details or sources other than one disgruntled employee, yeh I’m not buying this at all. They probably count azure or AWS as a “random cloud server”.
Really scraping the bottom of the barrel for anti-doge/elon content these days.
Yeah, god forbid we have people who aren't fucking idiots taking care/maintaining our information.
I've got him tagged as "likes Elon" just as a heads up.
You should put a little star next to the tag to complete the irony of it.
Don't recognize clanker pronouns, that's a bot!
But again - this has zero information. What cloud storage is it on? How is it not secure?
If you read the article, the current head of the SSA acknowledges they did set up the system being discussed and that he's accepted the increased risk of the implementation as there is a "business need".
What cloud servers are they using?
Given it's the government it's most likely AWS or Azure. That really isn't inherently bad, it's more the attitude of "move fast and break things" doesn't necessarily work for secure systems with sensitive data.
So again, it’s all just bullshit hopes and dreams by the anti-doge people. No data has been exposed or hacked, no evidence of it actually being on anything insecure.
In cyber security you may never know if a bad actor got access to your systems/data. The issue with not following good security practices is that you increase the risk of this happening.
Its like saying we should stop mandating vaccines cause the diseases aren't around anymore. When you let down your defenses you end up with outbreaks that shouldn't have happened and are harder to control.
If they're using Azure or AWS then they have a level of built in good security practices. These people aren't morons, they know what they're doing. In fact, using AWS or Azure you have to fuck things up to make it insecure, because by default they're all pretty locked down.
I'm 100% a pro-vaccine person, but vaccines should not be mandatory. "My body, my choice" - isn't that the saying? Or is that only for women wanting an abortion? If someone doesn't want to get a vaccine then they can suffer the potential consequences while those who are vaccinated don't (but they have to deal with the potential side effects of the vaccine).
While AWS/Azure do make the initial configs rather fool proof, that falls apart the moment you start configuring them for actual use. It's also especially easy to mess things up when handling PII, at the SSA level it's probably something that DOGE staff don't have experience with.
As for vaccines. Largely through that out there cause it seemed like obvious bait for you, but I don't think a single slogan "my choice my body" really encapsulates the arguments around abortion