--:-- Aisha Roscoe: I'm Aisha Roscoe, and this is a Sunday story from Up First. And today, we've got a big one. Recently, NPR reporter Jenna McLaughlin broke open a huge story about a whistleblower from inside the federal government. His name is Daniel Barulis, and for him, it all started on a Friday at the end of February.
--:-- Jenna McLaughlin: I remember the moment vividly. I was at home, and I got a call from my boss saying, "Hey, my boss wants us to come in next week. It's possible that Doge will show up."
--:-- Aisha Roscoe: On Monday, he sees a black SUV with a police escort pull into the parking garage at their office in D.C. Daniel didn't speak to anyone in the SUV, but he assumes it was members of the Department of Government Efficiency, or Doge. He'd been hearing about Doge showing up with police escorts around town.
--:-- Jenna McLaughlin: And based on that call with his boss, he was expecting them to arrive that day. They didn't want to interface with us, the admins. They wanted system access to the cloud. That's what they were there for. And access to the cloud they got.
--:-- Aisha Roscoe: This is Barulis' whole job, to guard the sensitive data in the cloud of his agency. He works at the National Labor Relations Board, or NLRB, which is a small, independent federal agency that enforces the law to protect people from unfair labor practices, like when a corporation wants to illegally punish workers for organizing a union.
--:-- Jenna McLaughlin: After the Doge team arrived, Barulis saw one red flag after another, indicating that sensitive data at the NLRB was at risk. It scared him enough to come forward as a whistleblower. He filed a disclosure with Congress, and he approached me at NPR.
--:-- Aisha Roscoe: Barulis' story gives us a rare look at what Doge was doing inside this agency, and perhaps inside many others. And also, what that means for the census of data of millions of Americans.
--:-- Jenna McLaughlin: I've covered cybersecurity for over a decade. Stephen Fowler is also with us. He's been focusing on the big picture of the federal government's restructuring under President Trump.
--:-- Stephen Fowler: Thanks for having us.
--:-- Aisha Roscoe: So tell me a bit about this particular whistleblower at the NLRB. Like, who is he?
--:-- Jenna McLaughlin: Yeah, I was lucky enough to speak to Barulis at length. He even got notes. I have my timeline, my handwritten. So let me get that out before I start. And got to learn a lot more about him and what makes him tick.
--:-- Aisha Roscoe: Let's just start off with you introducing yourself. Sure. Tell me a little bit about you.
--:-- Daniel Barulis: So, um, my name is Daniel. When I was 16, I got a computer for my birthday instead of a car, and I just took it apart to see how it worked and put it back together. I fell in love. I found the first video game I could play, and it broke. And then I fixed it by just learning every little bit about how the hardware works and what parts are broken and what's doing what.
--:-- Aisha Roscoe: He did the same thing with electronics from the thrift store, actually. He would buy radios and take them apart. He even said that he once got nearly electrocuted messing around with all the electronics.
--:-- Daniel Barulis: My pastime is I like to understand how things work. And he's worked in this field for many years. Prior to being in the government, he was a technical consultant. He was a specialist actually doing auditing of corporate systems.
--:-- Aisha Roscoe: So exactly the kind of stuff that Doge does that they're trying to do, that was actually Barulis' job.
--:-- Daniel Barulis: He says he decided to join the NLRB because he was really interested in public service. He had done volunteer firefighting in the past. He had worked for a rape crisis line, but he wanted to use his technical skills to do more.
--:-- Aisha Roscoe: The agency that I work at, they have a very specific mission. They are really the voice of the downtrodden and unincorporated worker when they try to make working conditions better for themselves or their coworkers and management comes in and punishes them or fires them.
--:-- Daniel Barulis: That's where the NLRB steps in. So his job at the NLRB specifically is to secure the cloud-based systems. He reinforces who gets access to those systems and he helps keep out attackers.
--:-- Aisha Roscoe: So Daniel Barulis has been working in cybersecurity for a long time. Walk me through what he saw when the Doge team accessed the NLRB systems.
--:-- Jenna McLaughlin: So normally anyone working on these systems, once they create an account, there's a ticket filed. You get to track a little bit about what that account is doing. But when the Doge staffers came in, Barulis said that his colleagues were asked not to track anything, to just completely act like they were never there.
--:-- Aisha Roscoe: The instructions given were very specific, and that was, do not log the accounts, don't log the access, and stay out of our way.
--:-- Jenna McLaughlin: How unusual is that request not to log? Like, does that happen often or are there special situations where they don't log?
--:-- Daniel Barulis: It's really unusual. Every expert I talked to for this story, over 10 people said, there's absolutely no reason that you wouldn't want your activity logged if you're doing something legitimate.
--:-- Aisha Roscoe: Because at the bare minimum, it allows you to troubleshoot, to fix errors that are completely benign. If there is a potential breach or a concern about a cybersecurity issue, it gives you a lot of clues about what systems affected, what happened, which users were involved.
--:-- Jenna McLaughlin: So, yeah, it's extremely problematic, and it really set off some red flags for Barulis.
--:-- Aisha Roscoe: To give somebody a global admin account and not log or not track their activities or access, That's keys to the kingdom.
--:-- Jenna McLaughlin: I'm going to close my eyes now and trust you. That's something that you just don't do. It violates every core concept of security and best practice.
--:-- Aisha Roscoe: It's important to say when we asked NLRB for comment on this story, they said they had no official record of Doge visiting, that they'd never authorized Doge accessing their systems, that Doge had never requested access.
--:-- Jenna McLaughlin: Of course, that's counter to Barulis' official disclosure, plus records of internal communication seen by NPR and the forensic evidence that we've been looking at.
--:-- Aisha Roscoe: It's really possible that this first visit and this request not to log access was outside senior leadership's awareness that they didn't know about it.
--:-- Stephen Fowler: So the big thing I want to talk about here is the Privacy Act. It was passed in 1974, and that's a lot of the backbone of these lawsuits challenging Doge's access.
--:-- Aisha Roscoe: Congress decided 50 years ago that there shouldn't be this so-called God mode in government, And there shouldn't be the ability for one person or a small group of people to be able to access virtually anything and everything about somebody that the federal government keeps.
--:-- Stephen Fowler: I mean, there's Social Security numbers, employment information. You've got immigration information, bank accounts.
--:-- Aisha Roscoe: The thing I want people to realize about this is that there is so much that we entrust to the federal government and federal agency data-wise that individually doesn't say that much. But now there are people affiliated with DOGE that have access to that information and also have access to the Social Security Administration and your Social Security number and any statements and benefits.
--:-- Stephen Fowler: And so even if they don't use it that way, we are now at a point where a small handful of people could build dossiers on people and do who knows what with it.
--:-- Aisha Roscoe: And that's something that has concerned people across the ideological spectrum who are very much worried about privacy.
--:-- Jenna McLaughlin: Yeah, Aisha. So for the first couple of days, Barulis was continuing to do his job as normal. He went home on the weekend, and then he noticed that this political reporter, Roger Sollenberger, tweeted about one of the Doge engineers and his public GitHub page.
--:-- Aisha Roscoe: So basically, that's a place where you can host coding projects, collaborate with other people on that project.
--:-- Jenna McLaughlin: And he noticed that a project was deleted or made private before he was able to figure out what it was. But the name was really interesting. The name of that project was NXGen BDoor Extract.
--:-- Aisha Roscoe: NXGen is the name of an internal system that was designed specifically for the NLRB in-house, built just for them.
--:-- Jenna McLaughlin: And because of that name, Barulis was freaked out. what is this file? Like, what is he looking at?
--:-- Aisha Roscoe: Yeah, every single person I talked to about this immediately just gasped. They were shocked that someone would actually call something this because the name B-door essentially implies that you're building a backdoor or a way to get into a system that's not authorized, a possible way to extract information.
--:-- Jenna McLaughlin: When I saw this tool, I immediately panicked. Just for lack of a better term, I kind of had a conniption and said, Whoa, whoa, whoa.
--:-- Aisha Roscoe: So to be clear, we were not able to recover the code for that project. We can't know exactly what the program was doing without seeing the details of that code.
--:-- Jenna McLaughlin: But, you know, even without knowing when it was created or how frequently it was used, the real importance of this is that it made Barulis concerned. That's when his real fears started to escalate.
--:-- Aisha Roscoe: And why did that scare him so much?
--:-- Jenna McLaughlin: Mostly because he was really scared of the data inside the NLRB getting out, particularly the data that lives in an extremely sensitive internal system, the case management system.
--:-- Aisha Roscoe: That's where all the case files live of ongoing NLRB investigations.
--:-- Jenna McLaughlin: So, Aisha, here's some of the kind of data that NLRB has. Personal information about union members or employees that are voting to join the union.
--:-- Aisha Roscoe: It has witness testimony in ongoing cases. It lists union organizers and leadership.
--:-- Jenna McLaughlin: And, you know, even if there's a possibility that that information was out in the wrong hands, we spoke to a lot of labor law experts who said that it could have a chilling effect.
--:-- Aisha Roscoe: It could scare people from forming unions or coming to the NLRB with concerns or testifying if they feel like that information isn't going to be secure.
--:-- Jenna McLaughlin: But, you know, even if you're not the biggest fan of unions, this agency also has sensitive business information.
--:-- Aisha Roscoe: Companies sometimes cooperate with investigations, whether it's an investigation into potential trade secrets or something along those lines.
--:-- Jenna McLaughlin: So it's possible that companies will have shared a lot of information about their internal workings that they also would not want exposed.
--:-- Aisha Roscoe: So help me understand what's really at stake here. Like, what really could come out of this data?
--:-- Jenna McLaughlin: I think, firstly, if someone had this data, they could use it to create blacklists of union organizers, fire a bunch of people, target harassment intimidation tactics at individuals involved in union activism.
--:-- Aisha Roscoe: It could even give a company an advantage in an ongoing legal battle with the NLRB.
--:-- Jenna McLaughlin: If you've got insight into the opposing counsel's notes, you can probably come up with a pretty good response.
--:-- Aisha Roscoe: Meanwhile, a foreign adversary or criminal hacker might be really interested in that data, too.
--:-- Jenna McLaughlin: They might hold it for ransom. They might learn more about their competitors' businesses or innovations.
--:-- Aisha Roscoe: And it's also possible that this data could be combined with some of the other sensitive sources of data that Stephen's been talking about to build a larger dossier on American citizens.
--:-- Stephen Fowler: So the National Labor Relations Board is just a small pocket inside the federal government. But we have some of the most detailed looks at what DOGE is doing and how they're doing it because of this whistleblower and also because of more than a dozen lawsuits.
--:-- Aisha Roscoe: These are federal court cases that I'm tracking and a handful of agencies challenging how DOGE has access to the sensitive data there and the fact that they even have access to the data at all.
--:-- Stephen Fowler: Individually, these cases paint isolated pictures about employee one having access to database one here and so on and so forth.
--:-- Aisha Roscoe: But we pulled all of these things together and found this pattern of a small number of Doge staffers being given access to virtually everything at all of these agencies that control just vast amount of data about millions and millions and millions of Americans.
--:-- Jenna McLaughlin: So, Aisha, this happened within minutes of those new accounts being created?
--:-- Aisha Roscoe: Because of all this, experts told me that they could see the possibility that Doge has been compromised.
--:-- Jenna McLaughlin: I spoke to Russ Handorf. He's a former FBI cyber expert. He said malicious cyber actors, whether they're criminals or hackers working for Russia and China, might be really interested in getting inside the NLRB systems.
--:-- Aisha Roscoe: And that's for a couple of reasons. First, we've heard U.S. government officials sounding the alarm for years about stealing U.S. intellectual property to benefit their own industries and companies.
--:-- Jenna McLaughlin: It might also be valuable for blackmail purposes or to hold the data for ransom.
--:-- Aisha Roscoe: But the thing about this is this cloud account could be connected to other government systems.
--:-- Jenna McLaughlin: And Handorf said that it could be a way for a hacker to jump off from NLRB and go somewhere else.
--:-- Stephen Fowler: Yeah, it is worth mentioning that at a lot of these agencies that Doge has had access to data, there is a benefit of the doubt to understand why they would have it.
--:-- Aisha Roscoe: For example, you know, at the Social Security Administration, they are looking at data to try to find evidence of people receiving benefits that they shouldn't have.
--:-- Stephen Fowler: This is nowhere like that. It could be used for business purposes, especially if you're Elon Musk.
--:-- Aisha Roscoe: His companies have several active cases before the NLRB.
--:-- Stephen Fowler: There's a group of former SpaceX employees that have lodged a complaint against Musk, as an example.
--:-- Aisha Roscoe: and Musk and SpaceX are part of a group of companies that have filed suit saying that the NLRB itself is unconstitutional.
--:-- Stephen Fowler: So in theory, if this data was taken by somebody affiliated with Doge and given it to Elon Musk, he could have access to sensitive information about these cases that have been filed against his companies, used to target lawyers or witnesses or other people involved with the case
--:-- Aisha Roscoe: Also it stuff about his competitors I mean there are multiple competitors that also have cases before the NLRB and also have trade secrets or other intercompany workings that are involved here
--:-- Stephen Fowler: Another thing I want people to think about is the potential for data scraping.
--:-- Aisha Roscoe: There's been a lot of reporting across the government about Musk and Doge and the use of artificial intelligence programs, you know, things like XAI and Grok that are being used to basically train on government data for things.
--:-- Stephen Fowler: So, Stephen, from what you're saying, it's like this story is likely bigger than just the NLRB.
--:-- Aisha Roscoe: Since Doge has gained access to several agencies at this point, how have cybersecurity experts at other agencies responded?
--:-- Stephen Fowler: Well, we have seen testimony in those federal court cases that I was talking about of people expressing alarm about how Doge had access to the data.
--:-- Aisha Roscoe: But at the same time, there isn't really much of a response because many of these cybersecurity professionals have resigned, been forced out, relocated, put on administrative leave, taken the buyouts that have been offered.
--:-- Stephen Fowler: So it's really hamstrung the ability to respond to or keep track of what Doge is doing.
--:-- Aisha Roscoe: I'm thinking specifically of Erie Meyer, a technologies who stepped down after Doge did something similar at the Consumer Financial Protection Bureau.
--:-- Jenna McLaughlin: Jenna talked to her for this story. She said, "I'm trembling. They can get every piece of whistleblower testimony, every report, everything."
--:-- Aisha Roscoe: This is not good.
--:-- Stephen Fowler: Another employee at the Department of Interior subagency who requested anonymity, fearing retribution, said their cyber teams are, quote, "pissed because they have to sit on their hands when every single alarm system we have regarding insider threats is going off."
--:-- Aisha Roscoe: That's a lot of red flags.
--:-- Stephen Fowler: How has the administration reacted?
--:-- Aisha Roscoe: Trump issued an executive order that asked federal agencies to find ways to break down information silos and share non-classified data more easily across the federal agencies and to do so as applicable by law.
--:-- Stephen Fowler: But as we've seen here, their interpretation of what the law is, is different from some of these experts.
--:-- Aisha Roscoe: And Aisha, the White House gave us a comment after we published. They said, essentially, it's old news that Doge is in federal agencies like the NLRB sharing data.
--:-- Stephen Fowler: They did not deny it.
--:-- Aisha Roscoe: So what else has happened since you broke the story last week?
--:-- Jenna McLaughlin: Well, the top Democrat on the House Oversight Committee, ranking member Jerry Connolly of Virginia, is calling for an investigation into Doge's access to the NLRB to get some answers.
--:-- Aisha Roscoe: Meanwhile, we got a copy of an email informing NLRB employees that two Doge staffers will embed with the NLRB for the next two months.
--:-- Jenna McLaughlin: You know, given the fact that folks like Connolly want independent investigations, it'll be hard to guarantee that those new Doge staffers aren't going to mess with any forensic evidence while they're there.
--:-- Aisha Roscoe: We're also hearing some IT staff have been locked out of the systems that they work on.
--:-- Jenna McLaughlin: Basically, they can't see what's going on or do their job.
--:-- Aisha Roscoe: With all of this, I'm still thinking about the whistleblower Barulis and, you know, the picture of him walking his dog and all of that.
--:-- Jenna McLaughlin: Across administrations, we have seen that being a whistleblower can be dangerous.
--:-- Aisha Roscoe: Is Barulis still at the NLRB now?
--:-- Jenna McLaughlin: Barulis is still employed at the NLRB, and we haven't heard any indication that he's going to be put on administrative leave or fired.
--:-- Aisha Roscoe: In their statement, NLRB told us that they're committed to protecting their employees' rights to make official disclosures to Congress and that they will cooperate with any investigation.
--:-- Jenna McLaughlin: But I think you're right. It's a really scary moment right now.
--:-- Aisha Roscoe: And for him to know that these Doge staffers might be in the office with him after he raised these concerns, it's really troubling.
--:-- Jenna McLaughlin: But Brulis felt like it was really important to do this. He said it was a moral imperative that he has never encountered something like this in his 20 years of IT.
--:-- Aisha Roscoe: I wouldn't be able to live with myself otherwise. To know that this data was out there, it's going to impact these cases. It's going to cost people their real livelihoods.
--:-- Jenna McLaughlin: And for that to happen with nobody knowing what happened, that's the biggest travesty of all.
--:-- Aisha Roscoe: And I believe with all my heart that this goes far beyond just case data.
--:-- Jenna McLaughlin: I know that there are other admins at other agencies I've spoken to who have seen similar behavior.
--:-- Aisha Roscoe: And they are uncomfortable speaking up. They're uncomfortable reporting it because at the end of the day, they have families. They have things on the line that have been implicitly threatened.
--:-- Jenna McLaughlin: Standing up like this, I'm not hopeful for the outcome for me.
--:-- Aisha Roscoe: What I'm hopeful is that people look and say, hey, somebody else did it. I can do it too.
--:-- Jenna McLaughlin: And if enough people stand up, it can form a movement.
--:-- Aisha Roscoe: And these practices that they're breaking security and violating and stealing data without anyone knowing, it can be stopped.
--:-- Jenna McLaughlin: And he actually made a personal plea to the Doge engineers. It was a simple request. Be transparent. If you have nothing to hide, don't delete logs. Don't be covert about your entrance to agencies. Be open.
--:-- Aisha Roscoe: Because that's what efficiency is really about. If this is all huge misunderstanding, then just prove it. Put it out there. That's all I'm asking.
--:-- Stephen Fowler: Well, there are still so many questions unanswered, both with this specific story and with other impacts across the federal government.
--:-- Aisha Roscoe: So we are fanning out across the country, across federal agencies, tracking these changes, trying to understand how things are changing for the worse, for the better, or not at all.
--:-- Stephen Fowler: And, you know, there's these dozen court cases that are ongoing that there are just going to be more and more developments.
--:-- Aisha Roscoe: So this is a full court press from this team and from the entire NPR newsroom.
--:-- Jenna McLaughlin: Absolutely.
--:-- Aisha Roscoe: And meanwhile, we're already hearing from more federal workers after this story came out. They want to share more about what they're seeing at their agencies.
--:-- Stephen Fowler: So our team has a lot of work to do.
--:-- Aisha Roscoe: So if somebody is listening and they want to share some important information with you, where can they reach either of you?
--:-- Jenna McLaughlin: So the place to go is Signal. The encrypted messaging application Signal is a great tool.
--:-- Stephen Fowler: You know, it does a really good job of protecting the average user. It's not totally bulletproof if you're using a work device or if the phone itself is compromised, but for the average person, it does a really good job of keeping your data safe.
--:-- Aisha Roscoe: And, you know, just a note, for full disclosure, NPR's CEO Catherine Marr is chair of the board of Signal.
--:-- Jenna McLaughlin: To find us on Signal, click the little pen and pad in the top right corner of the app and search for our usernames.
--:-- Stephen Fowler: Mine's JennaMcLaughlin.54.
--:-- Aisha Roscoe: And Stephen's is MyNameWithoutVowels, S-T-P-H-N-F-W-L-R dot 25.
--:-- Jenna McLaughlin: Both of those are also at the bottom of our stories about this.
--:-- Aisha Roscoe: Jenna and Stephen, thank you so much for all of this incredible reporting on the changes happening in our government.
--:-- Jenna McLaughlin: Thanks for having us.
--:-- Stephen Fowler: Thanks for having us.
--:-- Aisha Roscoe: That's NPR's Jenna McLaughlin and Stephen Fowler. You can find more details of their reporting on the NLRB at npr.org.
--:-- Aisha Roscoe: This episode of The Sunday Story was produced by Kim Naderfein, Petersa, and Andrew Mambo.
--:-- Aisha Roscoe: It was edited by Liana Simstrom, Irene Noguchi, and Brett Neely.
--:-- Aisha Roscoe: The mix engineer for this episode was Jimmy Keely.
--:-- Aisha Roscoe: The Sunday Story team includes Justine Yan and Jenny Schmidt.
--:-- Aisha Roscoe: We always love hearing from you, So feel free to reach out to us at the Sunday story at NPR.org.
--:-- Aisha Roscoe: I'm Aisha Roscoe up versus back in your feed tomorrow with all the news you need to start your week until then.
--:-- Aisha Roscoe: Have a great rest of your weekend.
