In a report by Fedscoop, the General Services Administration is failing to effectively protect controlled unclassified information within its Google Drive environment, leaving sensitive data exposed to all agency users and contractors.
The Office of the Inspector General discovered 116 files containing sensitive data, including Social Security numbers, dates of birth, vendor proposals and physical security blueprints. The breach stems from poor management of a third-party data loss prevention tool, which cost the agency 7.8 million dollars. This software failed to detect files exceeding 15 megabytes or documents labeled for official use only. Furthermore, the agency lacked standardized naming conventions and failed to conduct consistent annual reviews of search terms between 2015 and 2024. With approximately 2.5 million documents stored in the system, the oversight poses significant reputational and legal risks. While Chief Information Officer David Shive noted that no external exposure or malicious intent was identified, the agency has committed to implementing seven recommendations to improve security. These include identifying additional exposed documents and enhancing the oversight of data protection software. The agency has since initiated corrective actions to update internal policies and strengthen the security of its Google Workspace environment.
Source: Fedscoop
