GSA Inspector General: Security Files Open on Google Drive

The General Services Administration’s inspector general found 116 sensitive files open to every Google Drive user at the agency, including floor plans marking judges’ chambers and jury rooms and a building collapse analysis. The watchdog first flagged the same kind of problem in 2014. GSA says nothing leaked outside the agency.

Floor plans marking gun lockers, judges’ chambers, jury rooms and X-ray screening areas. A “progressive collapse analysis” describing where a federal building would fail. Site plans for a Washington, D.C. facility that mark its entrances, its badge-holder and visitor routes and how visitors are screened. All of it sat in the General Services Administration’s (GSA) Google Drive, where any of the agency’s employees or contractors could open it, according to an audit released by the GSA Office of Inspector General on October 27, 2026.

The report, “Controlled Unclassified Information in GSA’s Google Drive Was Improperly Exposed” (Report Number A250043/I/T/F27002), found 116 files containing controlled unclassified information (CUI) “that were improperly shared with all GSA users.” CUI is the federal category for material that is not classified but that law or policy says must be protected, such as building security details, Social Security numbers and vendors’ trade secrets. GSA, the agency that manages much of the government’s office space and buys goods and services for other agencies, keeps an estimated 2.5 million documents in the drive.

The finding is not new. The inspector general first warned in August 2014 that GSA was leaving sensitive building information open in its Google environment. GSA put a data loss prevention tool in place that year to catch such exposures and, by its own figure, has spent about $7.8 million on it as of September 2026. The audit found the tool missed more than a third of the exposed files it was built to find.

What the coverage has missed

Trade coverage, such as ExecutiveGov’s October 29 report, has focused on the headline count of 116 files. Three points in the report itself deserve more attention.

The 116 files are a floor, not a total. The auditors used what they call “judgmental sampling”: for each of 39 search terms, they reviewed results only “until we identified 10 or more exposed CUI documents.” They state that they “cannot project these results to the full population.” In other words, nobody knows how many of the 2.5 million documents are exposed.
Institutional memory walked out the door. Asked when the tool’s search terms were last reviewed, the responsible division director said it was hard to know “because the GSA personnel responsible for those reviews are no longer with the Agency.” Nine search terms that watched for files shared outside GSA had been switched off, and current staff could not say why.
A fix sat available for more than a year before anyone noticed. The tool’s vendor told GSA in October 2023 that the product could read text inside images. GSA’s security operations staff said they did not know about the feature until the inspector general raised it in April 2025.

Background: twelve years of warnings

GSA has used Google’s cloud tools since at least 2014. On August 19 of that year, the inspector general issued an alert report finding that “sensitive but unclassified building information” was available to GSA employees and contractors “regardless of their need to know.” The exposed material covered “child care centers, courthouses, water sources, building automation systems, and security and fire alarm systems,” the new report recounts.

Further reports followed. In January 2015 the watchdog found personal information on at least 907 government employees, contractors and job applicants left open, including Social Security numbers, passport and driver’s license numbers and medical and dietary needs. In January 2017 it found GSA could not show it had told those people their information had been shared across the agency.

The current audit began in 2025 and turned up problems almost at once. On April 18, 2025, Deputy Inspector General Robert C. Erickson Jr. sent then-Acting Administrator Stephen Ehikian an alert memorandum warning of an issue “that warrants your immediate attention.” It described exposed safety surveys with detailed blueprints, a courthouse feasibility study marking grand jury rooms and U.S. Marshals Service offices, nine documents marked as CUI, and a vendor invoice with a full bank account number and wire transfer details. The building names are blacked out in the public version.

News outlets filled in some of the blanks at the time. Axios, following a Washington Post report, said the material included White House floor plans and “details of a proposed blast door for the White House visitor center.” Straight Arrow News, also citing the Post, said the folder had been shared with “more than 11,200 GSA employees.” RSN has not seen the Post’s underlying documents, and the inspector general’s reports do not name the buildings. In October 2025 a second alert memorandum reported similar exposures in GSA’s Google Groups, including aircraft capability descriptions and procurement cost data.

Deep dive: what was exposed and why it was missed

The files

Of the 116 exposed documents, 64 (55.2 percent) held physical security information. The report lists site plans, a continuity of operations plan covering scenarios that include “massive explosion, civil disturbance, and weapons of mass destruction,” and an occupant emergency plan that identifies the safe haven locations for a child care center in a Washington building. Appendix D also lists operational requirements for Top Secret/Special Compartmented Information networks, with a floor plan of sensitive areas, and drawings showing a “seized evidence room.” Several carried explicit warnings such as “FOR OFFICIAL USE ONLY.”

Another 23 documents (19.8 percent) held vendors’ proprietary business information, including ten responses to GSA requests for quotations with labor rates and pricing. Five documents (4.3 percent) contained personal information. One was federal employment paperwork showing a person’s full name, Social Security number, place and date of birth and phone numbers. Another was a police traffic collision report with names, dates of birth and addresses of three people.

The exposure was internal. These files were open to everyone with a GSA Google account, not to the public. GSA policy, however, requires that CUI be available “only to those individuals with a lawful government purpose,” and the agency’s own intranet tells staff to “Avoid sharing with ‘all GSA’ or ‘anyone with the link.'” A GSA security manager told auditors that “nothing prevents employees from granting unlimited access to CUI,” the report says, and that staff could create a shared drive, “add terabytes of PII to it, and then share it with whomever they feel should have access.” (PII is personally identifiable information.)

The $7.8 million tool

GSA’s main safeguard is a commercial data loss prevention tool that scans documents shared agency-wide for keywords such as “For Official Use Only” and then restricts them, alerts security staff or emails the owner. GSA’s response to the audit names it as CloudLock. The inspector general found six weaknesses in how GSA ran it.

It missed its own keywords. The tool failed to flag 40 of the 116 files (34.5 percent) even though they contained current search terms. Thirty-four contained “For Official Use Only.”
Its word list was thin. Auditors found 136 terms in GSA’s own CUI guidance that the tool could use. GSA had loaded 10. Missing terms included “personally identifiable information,” “occupant emergency plan” and “driver’s license number.” The tool did not search for “CUI,” the marking GSA’s manual calls for.
Annual reviews were not done. GSA’s procedure requires a yearly review of the search terms. For the ten years from 2015 through 2024, records were missing for five (2015, 2018, 2021, 2022 and 2023), and the other five did not show a completed review.
Large files were invisible. The tool cannot scan files over 15 megabytes. Ehikian himself wrote to the inspector general in 2025 that this was why it missed 10 of 15 documents in the April alert, yet the security division’s leaders said they had not known about the limit. Fourteen of the 116 files (12.1 percent) were above it, including the collapse analysis.
An image-reading feature sat unused. The vendor notified GSA in October 2023; the feature was not in use during the audit. GSA says it has since deployed it.
Decisions were not written down, including the deactivation of nine search terms.

The report also found that GSA has no approval step before an employee shares a document with the whole agency and no standard naming convention that would help software spot CUI.

GSA’s response and the counter-arguments

GSA Chief Information Officer (CIO) David Shive agreed with all seven recommendations in an October 5, 2026 memo printed in the report. He added a qualification: “Please note that GSA IT’s review determined that the identified documents were not exposed externally, and that, based on file access reviews and user interviews, there was no indication of malicious intent.”

That point carries real weight. The people who could open these files were GSA employees and contractors with agency accounts, and the report documents no misuse and no outside breach. Shive also said GSA IT “took significant corrective actions” while the audit was underway, including reviewing documents shared domain-wide, restricting access, and deploying the image-reading feature “to improve detection of sensitive markings embedded in images.” The audit work ran from March to December 2025, so some problems it describes may already have been fixed.

There is also a fair argument about balance. GSA manages buildings used by many other agencies, and architects, project managers and contractors need to share drawings to do that work. A system that locks down every blueprint could slow projects. The inspector general’s own sample methods cut both ways: the 116 files cannot be scaled up into an estimate, so the true scale could be smaller or larger than critics assume.

RSN analysis: These defenses answer the question of harm, not the question of control. “Need to know” exists because insider threats and compromised accounts are real, and an account with access to everything gives an intruder access to everything. The more telling evidence is administrative. GSA could not produce records of its own reviews, could not explain why monitoring was turned off, and did not know the limits of a tool it had paid for since 2014. Those failures span administrations of both parties. According to Axios, a GSA official said the files in the April 2025 alert were believed to have been uploaded entirely during the Biden administration, while that alert reached GSA leadership under the current one.

What is established, disputed and not established

Established (from the inspector general’s report and GSA’s signed response):

Auditors found 116 CUI files shared with all GSA Google Drive users; 64 held physical security information, 23 proprietary business information and 5 personal information.
The data loss prevention tool missed 40 files that contained its own search terms; GSA had spent about $7.8 million on it as of September 2026.
GSA lacked complete annual review records for every year from 2015 through 2024.
GSA’s CIO agreed with all seven recommendations.

Disputed or qualified:

How serious the exposure was. GSA says nothing left the agency and it found no malicious intent; the inspector general says the files were open to people with no business need to see them, which GSA’s own policy forbids.
Why the tool missed files with current search terms. GSA’s security division director pointed to a weakness that kept the tool from working as intended; auditors said they “were not able to determine specifically why.”

Not established:

How many CUI files are exposed across all 2.5 million documents. The sample cannot be projected.
Whether anyone without a need to know actually opened, copied or misused any file.
Which buildings are involved. The names are redacted; press reports in 2025 identified the White House in the earlier alert, but RSN has not independently confirmed that.
Whether the people whose personal data was exposed have been notified, as the report recommends. In 2017 the inspector general found GSA could not show it had notified earlier victims.

What accountability would look like

A full count. GSA should run an agency-wide scan of all 2.5 million documents, now that the image-reading feature is on, and report the number of exposed CUI files to the House Oversight and Senate Homeland Security committees.
Notification with proof. GSA should notify every person whose personal data was exposed and give the inspector general documentation, closing the gap the watchdog found in 2017.
Tenant agencies told. Courts, the Marshals Service and other occupants whose building plans were exposed should be informed so they can judge their own risk.
A sharing gate. Agency-wide sharing of any document should require supervisor approval, as GSA IT officials told auditors they were considering.
A value-for-money review. Congress should ask what $7.8 million bought, and whether a tool GSA did not keep current for a decade should be renewed, replaced or properly staffed.
Public follow-up. The inspector general should publish an implementation review on a fixed date rather than discovering the same problem again.