Latest / Elon Musk Podcast / DOGE put Social Security numbers on cloud server at risk of hacking

Transcript

DOGE put Social Security numbers on cloud server at risk of hacking · Elon Musk Podcast

• 0:01
  Hey everybody, welcome back to the Elon Musk Podcast.
• 0:05
  This is a show where we discuss. The Critical.
• 0:07
  Crossroads, the Shape, SpaceX, Tesla X, The Boring Company and
• 0:12
  Neurolink. I'm your host, Will Walden.
• 0:16
  A former Trump campaign aide A former Trump campaign aide is at
• 0:24
  the center of a federal data breach that leaks Social
• 0:26
  Security numbers of over 200,000 Americans, raising urgent
• 0:30
  questions about how a meme, a cryptocurrency project, gained
• 0:34
  access to sensitive government systems.
• 0:38
  Now the breach involves Doge Labs, a little known crypto
• 0:41
  startup run by Tommy Rensing, who previously worked for Donald
• 0:45
  Trump's 2020 campaign in digital strategy.
• 0:49
  Doge Labs had a contract with the US government to run a bot
• 0:53
  detection system under the pretense of helping federal
• 0:56
  agencies track misuse of public benefits.
• 1:00
  Instead, the company allegedly mishandled the personal data
• 1:03
  with Social Security recipients, exposing it in a breach that
• 1:07
  took place over several months. Federal investigators found that
• 1:11
  Social Security numbers, birth dates, addresses and benefit
• 1:15
  payment details or accessible through an unsecured interface
• 1:19
  connected to Doge Labs back end system.
• 1:23
  The briefs didn't stem from a malicious attack at all, but
• 1:26
  from severe misconfigurations and how the system handled and
• 1:30
  stored sensitive data. Americans sensitive personal
• 1:34
  data. You should be mad about this.
• 1:37
  Your Social Security number, your birthday, your address and
• 1:40
  benefit payment details could have been leaked by these
• 1:44
  unprofessional people. There are rules for a purpose.
• 1:47
  Doge Labs reportedly left a staging server online without
• 1:51
  basic access controls. Anyone with the URL could scrape
• 1:55
  the data in bulk. I've set up staging servers
• 1:59
  before for clients. Could be an AWS server, it could
• 2:03
  be any other cloud service. We're not sure where it was at
• 2:07
  this point, but we're going to dig into this and we're going to
• 2:11
  let you know exactly what happened.
• 2:13
  But Doge Labs secured the contract through a pilot program
• 2:15
  designed to bring innovative tech startups into federal
• 2:18
  service procurement pipelines. The program fast tracked vendors
• 2:23
  who could demonstrate AI and machine learning capabilities
• 2:26
  and renting pitch. Doge Labs is a tool that can
• 2:29
  detect fraudulent behavior in benefit claims using blockchain
• 2:32
  based identity scoring. The government bought the idea
• 2:36
  without fully vetting the system's infrastructure or
• 2:39
  compliance with data protection protocols, and the exposure
• 2:43
  affected data from at least three federal agencies, Social
• 2:46
  Security, the Department of Health and Human Services, and
• 2:50
  the Department of Veterans Affairs. 3 absolutely important
• 2:57
  agencies. All three used DOGE Lab software
• 3:00
  as a part of an experimental fraud prevention initiative
• 3:03
  launched in 2023. Internal emails reviewed by
• 3:06
  investigators show the concerns about Doge Labs data handling
• 3:10
  practices were raised as early as May, but federal tech
• 3:13
  officers dismissed the warnings as over cautious.
• 3:17
  Tommy Rensing has denied wrongdoing.
• 3:19
  It claims that no actual data was stolen.
• 3:22
  He described the system as safe and secure and said any exposure
• 3:25
  was due to a minor miscommunication between
• 3:28
  subcontractors that contradicts federal findings that the data
• 3:32
  was not only accessible but also downloaded by outside parties
• 3:36
  over a period of five weeks before the server was taken
• 3:41
  offline. No details about these outside
• 3:45
  parties who has downloaded it, but they did it over 5 weeks.
• 3:49
  They have all of your data now. If you think that's not
• 3:53
  important or you're just going to miss push that to the side,
• 3:57
  that's on you. But your Social Security number,
• 4:00
  your benefits, VA, etcetera were all exposed due to this DOGE
• 4:05
  subcontractor. The government has not publicly
• 4:09
  confirmed how many people were affected, but an internal audit
• 4:13
  found 212,415 Social Security records had been exposed.
• 4:17
  212,000 people at Social Security numbers have been
• 4:23
  exposed and downloaded for five weeks straight.
• 4:27
  Most of the individuals are recipients of Medicare,
• 4:30
  disability or VA benefits. The breach impacted elderly and
• 4:36
  low income Americans more so than anybody else.
• 4:39
  Several civil rights groups were preparing lawsuits, as they
• 4:43
  should, and demanding answers about why a crypto startup but
• 4:46
  no public track record was entrusted with such sensitive
• 4:50
  federal systems. Now, mind you, I'm a reporter.
• 4:55
  I'm neither here nor there. I'm right down the middle and I
• 4:58
  call it like it is. If these people messed with your
• 5:02
  Social Security numbers or messed with your VA benefits,
• 5:07
  they did something absolutely wrong.
• 5:11
  Absolutely. And they should feel the wrath
• 5:13
  of all these lawsuits because you know what?
• 5:17
  It's not about left or right. It's not about your stupid
• 5:19
  politics at this point, any politics.
• 5:21
  This is about people stealing trustworthy Americans data
• 5:27
  because they were they were unsecure in their ways of doing
• 5:36
  business. Doge Labs.
• 5:39
  How dare you. How dare you.
• 5:41
  A staging server, Really A public date staging server where
• 5:45
  anybody with the URL could scrape your data.
• 5:47
  It takes about 10 minutes to create a scraping bot if you
• 5:51
  have the URL to a a website and also if you have a URL to a
• 5:56
  website where all the data is out there in the open.
• 5:58
  If you have a link, literally all you need to do for some
• 6:05
  instances is control all control a control copy, put it into a
• 6:12
  spreadsheet, control paste and run it through chat TBT, see if
• 6:19
  you can get any great data out of it.
• 6:21
  And if you can, that's good for the hackers that did this, that
• 6:26
  hacked into the system. You know what hackers will hack
• 6:30
  and these people should have been absolutely secure with your
• 6:34
  data. This is your data, Americans.
• 6:37
  These people at Doge Labs did you dirty.
• 6:41
  I want you to know that sometimes I get up in arms about
• 6:45
  some stuff. Stealing people's data, stealing
• 6:48
  people's sensitive veteran data. If you're a true American, if
• 6:52
  you're a patriot, you have to support the veterans.
• 6:57
  Everybody should support veterans anyway.
• 6:59
  They've done some crazy stuff in their life.
• 7:03
  They've, they've sacrificed a lot so we can stay free.
• 7:07
  So these people mess with veterans.
• 7:11
  They should get messed with too. In of court, of course, court
• 7:15
  and legal battles. But this isn't the only
• 7:20
  controversy surrounding Doge Labs right now.
• 7:24
  According to documents viewed by The Telegraph, the company used
• 7:28
  the same infrastructure to promote a meme coin campaign
• 7:31
  that launched just weeks before the breach was discovered.
• 7:36
  OK, so the DOE, the Dogecoin derivative token which is DOGE
• 7:39
  dot Fed, was hyped on social media as a pro Trump financial
• 7:43
  movement, with rensing using his campaign connections to attract
• 7:47
  far right influencers and fringe candidates.
• 7:51
  Several of those promotions included footage filmed at
• 7:53
  federal offices, which may violate ethics laws around
• 7:59
  commercial activity on government property.
• 8:03
  Come on man, this Rensink. Come on man you are a clown.
• 8:10
  Why do you OK now? The timing has raised questions
• 8:14
  about whether Rensink used his government access for personal
• 8:16
  or political gain. Looks like a little bit of both.
• 8:19
  You registered, dodged out feds smart contract.
• 8:22
  Just 10 days before he began the government pilot, he directed
• 8:25
  internal staff to use government funded servers for performance
• 8:28
  testing of the crypto token. Government funded servers for
• 8:35
  his own personal crypto token. This guy needs to get audited.
• 8:42
  Need to mess with him in court. I got to get him.
• 8:45
  Those servers were later identified as the source of this
• 8:47
  data exposure too. So anybody with access to these
• 8:50
  crypto coins and to test them, anybody should be questioned and
• 8:54
  they should be held accountable if they did anything wrong.
• 8:57
  Now, federal, federal fallout from the breach is already
• 9:00
  hitting Capitol Hill. Congressional aides confirm that
• 9:03
  Senate Democrats are preparing hearings into how the contract
• 9:07
  was awarded and what safeguards have failed.
• 9:09
  Some Republicans have also expressed concerns over the lack
• 9:12
  of oversight and tech contracting, though Trump allies
• 9:16
  have attempted to distance the former president and current
• 9:19
  president from rensing, calling him a volunteer with limited
• 9:24
  responsibilities. OK, so we all know that's not
• 9:28
  true. Limited responsibilities.
• 9:32
  Don't think that's true if you have access to Social Security
• 9:35
  numbers. That's not a limited security
• 9:37
  and lot limited authority, not limited responsibilities.
• 9:41
  You are absolutely not a volunteer if you have access to
• 9:45
  Social Security numbers. Now.
• 9:47
  The scandal also comes as Trump intensifies calls to gut the
• 9:51
  federal workforce. Now, at a rally this weekend, he
• 9:55
  praised Rensing's push for private innovation and said
• 9:58
  federal agencies should move fast and break things when
• 10:01
  dealing with fraud. Just like Silicon Valley, man,
• 10:04
  he's taking a play, a play out of, you know, a Meta.
• 10:10
  And all the Silicon Valley elites that I used to work for
• 10:15
  back in the day don't like him anymore.
• 10:18
  By the way, I like code. I like creating things.
• 10:22
  But Silicon Valley, it was a long time ago.
• 10:26
  Trump also proposed eliminating entire agencies like the
• 10:29
  Department of Education and the EPA to fund a new AI and crypto
• 10:34
  task force that would partner directly with private firms.
• 10:37
  Now, that approach echoes the kind of low accountability
• 10:40
  contracting that allowed Doge Labs to slip through our
• 10:44
  fingers. Now the offense of Management
• 10:48
  and Budget issued an immediate suspension of all contracts
• 10:51
  issued under the same tech pilot that approved Doge Labs.
• 10:55
  The White House also ordered a full review of every agency that
• 10:58
  uses third party AI for fraud prevention or citizen data
• 11:03
  handling. That review will likely result
• 11:05
  in stricter federal tech procurement standards and data
• 11:09
  access audits for existing contractors.
• 11:13
  Now Those Labs has deleted its website.
• 11:16
  It disabled all public phasing services, right?
• 11:19
  Singh is reportedly preparing a launch of a legal defense fund,
• 11:24
  arguing that the breach is being politicized ahead of 2026
• 11:27
  midterms. Meanwhile, affected users have
• 11:31
  begun receiving breach notifications, with some
• 11:33
  reported fraudulent activity on their credit reports within
• 11:37
  weeks of the leak. Wow, this is a horrible
• 11:41
  situation. How dare they do this to
• 11:45
  veterans and other people, people that don't have much.
• 11:49
  What? OK, I'm going to say it.
• 11:51
  What a scumbag. What a loser.
• 11:54
  Let me know what you think in your podcast comments because
• 11:58
  this is a this is a dirty one. This is a dirty one.
• 12:01
  Let me know what you think. All right.
• 12:03
  Take care, everybody. Hey, thank you so much for
• 12:06
  listening today. I really do appreciate your
• 12:08
  support. If you could take a second and
• 12:09
  hit the subscribe or the follow button on whatever podcast
• 12:12
  platform that you're listening on right now, I greatly
• 12:15
  appreciate it. It helps out the show
• 12:17
  tremendously and you'll never miss an episode.
• 12:20
  And each episode. Is about 10 minutes or less to
• 12:23
  get you caught up. Quickly and.
• 12:25
  Please, if you want to support the show even more, go to.
• 12:27
  Patreon.com slash. Stage 0 and please take care of
• 12:33
  yourselves and each other and I'll see you tomorrow.