GSA OIG finds 116 CUI files exposed in Google Drive
GSA says nothing left the agency, but 116 CUI files were shared with staff and contractors who had no business reading them.
TL;DR
GSA's inspector general found 116 files holding controlled unclassified information shared too widely inside Google Drive: Social Security numbers, phone numbers, vendor proposals, and a Washington, D.C. building's site plans. The OIG blamed deficient oversight of a third-party data-loss-prevention tool, plus missing approval and naming controls. GSA IT says nothing left the agency and there's no sign of malice, and the CIO agreed with all seven recommended fixes.
GSA's Office of Inspector General found 116 files containing controlled unclassified information shared improperly inside the agency's Google Drive, according to an audit released Tuesday and reported by Nextgov/FCW. The files held Social Security numbers, phone numbers, proprietary research, vendor proposals, and site plans for a Washington, D.C. building. They were shared with employees and contractors who lacked a legitimate business reason to know those details.
The OIG traced the exposure to missed controls rather than a single failure. GSA didn't complete annual reviews of a third-party data-loss-prevention tool's search terms, and it didn't incorporate "many relevant terms" from agency guidance. Some tool searches failed to detect documents that contained the terms they did use. The agency also hadn't turned on optical character recognition. It hadn't documented program decisions, and it wasn't aware the tool skips files larger than 15 megabytes. GSA likewise lacked an approval process for sharing sensitive information and a standard naming convention for CUI.
GSA IT's own review said the files were "not exposed externally" and found "no indication of malicious intent." That answers the breach question, but it doesn't answer the one the OIG raised. The audit's point is that need-to-know controls failed: 116 CUI files were shared with staff and contractors who didn't have a legitimate business reason to know the details. CIO David Shive agreed with all seven recommendations. He said GSA took corrective actions during the audit, including adopting optical character recognition and restricting access to domain-shared documents "as appropriate."
This is not the first Google-era finding. In 2014, the OIG found GSA hadn't protected information stored in its Google cloud environment. Practitioners running CUI in a shared drive can read the audit as a checklist: search-term review, OCR, file-size limits, approval workflow, and a naming convention.
Published ·Deep Fathom