Beginning on Inauguration Day 2025, Elon Musk's DOGE placed associates inside the Treasury Department with access to the Bureau of the Fiscal Service — the payment system that processes over $6 trillion in annual federal payments. The system handles tax refunds, Social Security benefits, veterans' benefits, Medicare payments, and federal salaries, and contains the Social Security numbers and bank account information of hundreds of millions of Americans.
\nTom Krause, the former Chief Financial Officer and President of Broadcom Software and current CEO of the Cloud Service Group, was installed as an unpaid \"senior advisor for technology and modernization\" at Treasury. This gave him access to one of the most sensitive financial databases in the federal government through a temporary special government employee arrangement.
\nMarko Elez, a 25-year-old software engineer, began working as a Treasury employee on January 21, 2025. In a revelation that crystallized the recklessness of the access controls, Elez was discovered to have been mistakenly granted \"write\" access to a sensitive payments database — meaning he had the ability to alter payment records in a system that disburses trillions of dollars annually. Treasury officials said the write privilege was given by mistake and revoked after one day upon discovery.
\nElez resigned on February 6 after the Wall Street Journal discovered racist social media posts he had made before joining DOGE, raising fundamental questions about the vetting process for individuals given access to the nation's financial infrastructure.
\nA coalition of 19 state attorneys general, led by New York AG Letitia James, sued the Trump administration alleging that DOGE was given unauthorized access to the payment system in violation of federal privacy laws. A separate lawsuit was filed by a group of union members and retirees.
\nOn February 8, US District Judge Paul Engelmayer issued a preliminary injunction blocking DOGE access, describing the approach as \"chaotic and haphazard\" and finding a risk of \"irreparable harm\" to Americans whose data was exposed.
\nDespite the district court findings, the 4th Circuit Court of Appeals reversed course in August 2025. In a 2-1 decision, the panel vacated the injunction, with Trump-appointee Judge Julius Richardson writing that the lower court had \"abused its discretion.\" The reversal gave DOGE access not only to Treasury payment systems but also to IRS systems containing comprehensive taxpayer information for virtually every American.
\nThe Privacy Act requires that access to personal records be limited to those with a legitimate need and proper authorization. The Federal Information Security Management Act (FISMA) mandates specific cybersecurity protocols for government systems. The chaotic access controls described by the court — including the accidental granting of write access — demonstrate failures under both statutes.
\nThe mistaken granting of write access to Marko Elez represents more than an administrative error. In a system that disburses $6 trillion annually, write access means the ability to alter payment records — to redirect payments, change amounts, or modify beneficiary information. Even if the error lasted only one day, it exposed the system to catastrophic risk and demonstrated that the access control framework was fundamentally inadequate.
\nThe Treasury payment system contains an extraordinary concentration of sensitive data: Social Security numbers, bank account and routing numbers, tax liability information, benefit payment histories, and federal salary records. Unauthorized access to this data enables identity theft, financial fraud, and political surveillance at a scale affecting virtually the entire American population.
\n