GSA watchdog finds sensitive files accessible to unauthorised staff and contractors
A US government watchdog found that sensitive documents in the General Services Administration’s Google Drive were shared with staff and contractors who had no business need to access them. The findings matter because the exposed material included personal data, building security details and confidential vendor information, and similar weaknesses have been reported for more than a decade.
The inspector general’s limited search identified 116 files containing controlled unclassified information shared with all GSA users; about 2.5 million documents are stored in the Drive. The report cited gaps in the agency’s data-loss prevention tool, including incomplete search terms, disabled text recognition for scanned files and a 15-megabyte file-size limit, as well as no formal approval process for sharing sensitive material. The exposed files included social security numbers, addresses, building plans and vendor proposals, while the watchdog said it first reported related problems in 2014.
In short
- A GSA audit found 116 sensitive files shared across the agency.
- The files included personal data, security plans and vendor proposals.
- Auditors have flagged similar protection failures since 2014.
Explained simply
The General Services Administration, or GSA, manages federal buildings and provides services to other US government agencies. Its Google Drive stores documents used by agency staff and contractors, including some marked controlled unclassified information: material that is not classified as a state secret but still needs protection.
The GSA inspector general is an independent watchdog that checks how the agency handles its work and resources. Sensitive files can include personal details, building security information and companies’ confidential proposals, so access is generally meant to be limited to people who need them for their jobs.
The issue sits within a wider effort to prevent sensitive information from being shared too broadly. Digital checks can miss material for reasons such as scanned text or limits on what the system searches, while unclear approval rules can make it harder to control who gets access.
Read the full article at the source →
Originally published by The Register as “GSA left sensitive Google Drive files open to staff, contractors”.