Exclusive: Whistleblower Alleges DOGE May Have Taken Sensitive Labor Data

This message comes from NPR sponsor Rosetta Stone, an expert in language learning for 30 years. Right now, NPR listeners can get Rosetta Stone's lifetime membership to 25 different languages for 50% off.
Learn more at rosettastone.com slash NPR. Hey there, this is Sarah Mosby from St.
Louis, Missouri. I'm currently in Tupelo, Mississippi, on my way to Birmingham, Alabama to see my best friend Paige.
This podcast was recorded at 1 20 p.m. Eastern time on Wednesday, April 16th, 2025.
Things may have changed by the time you hear it, but I'll be reunited with my very best friend. Thanks.
Enjoy the show, an NPR exclusive. A whistleblower alleges the entity known as DOGE may have improperly accessed data from the National Labor Relations Board and then tried to cover it up.
Jenna, let's first start with the basics here. What is the National Labor Relations Board and what is their role in government? Yeah, it is a really small, independent federal agency, but it's very important for protecting workers' rights.
So it investigates and adjudicates complaints about unfair labor practices. It helps make sure employees can form unions, that sort of thing.
All right. So let's talk about this whistleblower.
First of all, who is he and what is he alleging here? His name is Dan Baroulos. He works in the IT department for the NLRB and he watches over their cloud system.
He essentially alleges that after Doge arrived, they demanded the God tier access to the system, essentially said, stay out of our way, don't log anything that we're doing. And after that, once they had already left, Dan really got interested in what they had been doing and wanted to determine whether or not there were any security problems that happened.
So there was a big spike in data leaving the agency, about 10 gigabytes, which is like a giant stack of encyclopedias because all of them are text files. He saw a bunch of security tools turned off.
He saw records deleted. Just a lot of stuff that really got his spidey senses tingling after 20 or some odd years in IT.
Yeah. And when you say God tier, you mean like just like widespread info, like pretty much access to everything? Not even just access.
It means that they can alter, remove, do anything they want in the system, essentially. Yeah.
And Jenna, why would NLRB records be of interest to anyone? Like, what's in there? So one of the main systems we were interested in looking at is the case management system, where Dan said that he did see a giant spike in data leaving. And what's in there is internal union organizing stuff, lists of people interested in forming a union, lawyers notes of ongoing unfair labor practice complaints, even some corporate secrets when companies actually cooperate with some of these investigative cases.
And Ashley, I just want to zoom out just a little bit here. As you probably know, the Doge effort has been given this mandate from President Trump to find examples of waste, fraud, and abuse, mainly with government spending.
And everything that you just heard Jenna describe about what this case management system does doesn't really sound like waste, fraud, or abuse. And so that is something that makes this a little bit different from Doge going through every single federal agency and office that they've gone through so far.
Yeah, right. It's like the inner workings of private business and less about government spending, which is what Doge is purportedly tasked with looking at, right? Yeah.
I mean, even in your most charitable interpretation, it's possible that they didn't know what they were taking. But this internal case management system, Dan described it as kind of a nucleus.
It only has the sensitive information. So it's hard to get your head around the idea that they might have thought it was something else.
It's also worth pointing out that several of Elon Musk's companies are before the NLRB for unfair labor practice allegations. Also, several companies that are competitors of Musk's have sensitive data embedded in this system.
So there is the overall umbrella of Doge access concerns that people have about access to government data and financial information and other things on everyday Americans, then you have this entirely separate category here of this data, this agency, this manner and method of looking at things seems to have a purpose that primarily benefits the business interests of Elon Musk's separate from Trump's remaking of the federal government. Yeah.
And it's worth mentioning that some of the lawyers who represented SpaceX in a case arguing that the NLRB structure is unconstitutional now have government jobs in labor agencies. Oh, wow.
Well, I mean, do we have a sense, though, of why Doge is looking at the NLRB? I mean, have we heard anything from Musk or that group?

We haven't seen one.

The White House did respond to our reporting yesterday evening after we published.

They said that it's months old news that President Trump signed an executive order to hire Doge employees and coordinate data sharing.

They said that that included the NLRB and that, you know, they're looking for waste, fraud and, and they didn't really share much else. Okay, time for a quick break.
More in a moment. This message comes from Tenable.
Wondering where your biggest cloud security gaps are? Wonder no more. Tenable helps you find those gaps before attackers do.
They see cloud risks that others don't and give you the power to secure your entire cloud stack, from infrastructure to workloads, from identities to data, and even AI resources. Know your cloud risk, expose your cloud gaps, and close your cloud exposures fast.
Learn more at tenable.com slash cloud. Your cloud exposure ends here.
Support for NPR and the following message come from IXL Learning. IXL Learning uses advanced algorithms to give the right help to each kid no matter the age or personality.
Get an exclusive 20% off IXL membership when you sign up today at IXL.com slash NPR. This message comes from Thuma.
Create your oasis with Thuma, a modern design company that specializes in furniture and home goods.

By stripping away everything but the essential, Thuma makes elevated beds with premium materials and intentional details.

With clean lines, subtle curves, and minimalist style, the Thuma bed collection is available in four signature finishes to match any design aesthetic.

To get $100 towards your first bed purchase, go to thuma.co slash NPR. This message comes from Instacart.
If you don't know about flyer deals on Instacart, they're like strolling through your favorite store looking for deals, but you're scrolling your phone. And maybe you're in bed.
Because getting delivery doesn't mean you have to miss deals like you'd to cover up its actions at the NLRB. Why does that matter? And I mean, were they pretty successful at first at this? Yeah.
So, I mean, clearly not entirely successful because Barulis was able to uncover some of the evidence of this. But they did do a pretty good job at getting rid of information that would really link them to this removal of data.
And that would even allow the NLRB to know what data they took. So in that way, yes, they were successful.
And that's a big problem because if they did go hunting for specific data that would be advantageous to Elon Musk, then that would be a big red flag that I think a lot of investigators from Congress to law enforcement to the Office of Special Counsel would be really interested in. This is where it really gets back to the question about there being a good faith argument for visiting.
You know, a lot of the other audits and a lot of the other things that Doge has done has mostly been publicized. You know, they've got that wall of savings that hasn't been fully accurate, but there is a public accounting of sorts of the things that have been done.
You don't see that in this case. And really, it is an outlier in some ways from the DOGE operations across the federal government in other ways.
but it also ties into reporting that we've done, kind of tying together the different pieces of how Doge has access data at these places that is concerning. Well, I mean, Stephen, as you've mentioned, Doge has visited other agencies, them gathering information on what other agencies have been up to is not new, but I wonder how this lines up with the other work they've been doing in agencies across the federal government.
There are more than a dozen federal court cases, Ashley, that cover Doge access across different agencies. There's concerns over access to Social Security Administration data.
There's concerns over access to the Treasury payment systems that are the backbones of trillions of dollars in federal spending. There's concerns over access to personnel files at the Office of Personnel Management, basically like the HR backbone of the federal government.
And in isolation, these different cases allege similar things and talk about this person and this access. But we were able to kind of piece together a small number of DOGE staffers being given unprecedented access to unlimited information at all of these federal agencies, and in many cases, having access to multiple agencies worth of data.
So 50 years ago, when the Privacy Act of 1974 was put into law by Congress, they expressed concerns about these digital databases and any unelected bureaucrat being able to compile a dossier on you by combining this agency's data here with that agency's data here. And now in 2025, you have Doge people being given carte blanche to do that in real time.
So this is the most visible example of that that we've seen so far, because all of these court cases have taken time to go through. And this is a whistleblower disclosure, but this is not an isolated incident.
Yeah. And I mean, Ashley, I think going back to the good faith argument from just a pure cybersecurity standards perspective, there's no good reason, most of the experts that I spoke to said, to turn off logs.
There's absolutely no reason you would do that if you were actually looking to do a good job in terms of working on systems. Turning off logs is a cardinal sin to cybersecurity professionals because those things allow them to troubleshoot errors.
It lets them know what went wrong, whether that was a benign error or potentially even a hacker accessing the system through a vulnerability. Well, Jenna, what has happened since your reporting? Actually, in the midst of my reporting, after Dan raised some of his concerns internally, he received a letter that was taped to his door physically that essentially had a bunch of personally identifying information, stuff that's next to impossible to find online.
Believe me, I tried and sort of threatened him and included pictures of him walking his dog from overhead. His lawyer said that it appears to be from a drone.
So that was terrifying. Law enforcement's looking into it, but I mean, I think that's a crazy development as far as just the environment that currently exists for people that want to be whistleblowers.
And in the aftermath of the reporting, the ranking Democrat on the House Oversight Committee, Jerry Connolly of Virginia, sent a letter to the inspectors general of the NLRB and the Department of Labor asking a lot of questions that were raised by Jenna's reporting, asking about Doge's access and if anything was deleted and, you know, what's the meaning of this code that was found briefly on a GitHub page, which is like code repositories with something called NXGen BDoor Extract, NXGen being the name of the case management system. BDoor potentially meaning backdoor and extract.
Well, we know what that means. And so there are congressional questions.
There are these ongoing court cases. So this is the tip of this particular iceberg.
So what does Burla's hope comes of all of this? Like, what is he hoping happens next? Yeah, so we spoke to him in an exclusive interview, and he said that his hope is that it inspires other people to speak up, that it gets congressional investigators involved, that it gets agencies with more investigative resources involved, whether that's FBI or CISA, which is the Department of Homeland Security's cybersecurity and infrastructure security agency. He just wants this to be fully investigated.
And he's said multiple times that he hopes he's wrong, that none of this actually is malicious or concerning. He doesn't think that he is wrong, but he hopes that he is.
So he just wants this to be fully investigated and he wants, you know, the systems to be secure.

All right, let's leave it there for today.

And if you have any information you want to share with our reporters about Doge and what it may be doing, you can find information on how to contact them in our episode notes.

I'm Ashley Lopez. I cover politics.

I'm Stephen Fowler. I also cover politics.

And I'm Jenna McLaughlin. I cover cybersecurity.

And thank you for listening to slash NPR and use code NPR for 20% off your first purchase. This message comes from EasyCater.
Committed to helping organizations order and manage food for all their business needs. With search tools to help accommodate dietary preferences and stay on budget, plus flexible payment by credit card or invoicing.

EasyCater also offers employee lunch programs, tools to see and control food spend, and 24-7

live customer support, all on one platform. Learn more at easycater.com.