A US Treasury Threat Intelligence Analysis Designates DOGE Staff as ‘Insider Threat'

WIRED

07-02-2025

Vittoria Elliott Leah Feiger Feb 7, 2025 2:47 PM An internal email reviewed by WIRED calls DOGE staff's access to federal payments systems 'the single biggest insider threat risk the Bureau of the Fiscal Service has ever faced.' The US Treasury building in Washington, DC. Photograph:Members of Elon Musk's Department of Government Efficiency (DOGE) team have had access to the US Treasury Department's payment systems for over a week. On Thursday, the threat intelligence team at one of those systems recommended that DOGE members be monitored as an 'insider threat.'
Sources say members of the Bureau of the Fiscal Service's IT division and others received an email detailing these concerns.
'There is ongoing litigation, congressional legislation, and widespread protests relating to DOGE's access to Treasury and the Bureau of the Fiscal Service,' reads a section of the email titled 'Recommendations,' reviewed by WIRED. 'If DOGE members have any access to payment systems, we recommend suspending that access immediately and conducting a comprehensive review of all actions they may have taken on these systems.'
Although Treasury and White House officials repeatedly denied it, WIRED has reported that DOGE technologists had the ability to not only read the code of sensitive payment systems, but rewrite it. Marko Elez, one of a number of young men identified by WIRED who have little to no government experience but are associated with DOGE, was granted read and write privileges on two of the most sensitive systems in the US government: the Payment Automation Manager (PAM) and Secure Payment System (SPS) at the BFS, an agency that according to Treasury records paid out $5.45 trillion in the fiscal year of 2024.
'There is reporting at other federal agencies indicating that DOGE members have performed unauthorized changes and locked civil servants out of the sensitive systems they gained access to,' the 'Recommendations' portion of the email continues. 'We further recommend that DOGE members be placed under insider threat monitoring and alerting after their access to payment systems is revoked. Continued access to any payment systems by DOGE members, even 'read only,' likely poses the single greatest insider threat risk the Bureau of the Fiscal Service has ever faced.'
The recommendations were part of a weekly report sent out by the BFS threat intelligence team to hundreds of staffers. 'Insider threat risks are something [the threat intelligence team] usually covers,' a source told WIRED. 'But they have never identified something inside the Bureau as an insider threat risk that I know of.'
The Treasury Department and the White House did not immediately respond to a request for comment.
Got a Tip?
Are you a current or former employee at the Treasury or Bureau of the Fiscal Service? Or other government tech worker? We'd like to hear from you. Using a nonwork phone or computer, contact the reporters securely on Signal at velliott88.18 and leahfeiger.86.
The email also details this week's Treasury lawsuit, which resulted in a federal judge granting an order on February 6 to temporarily restrict DOGE staffers from accessing and altering payment system information.
In a section of the email titled 'Analyst Notes,' the email delves into the fallout from the suit.
'A court order formalizing an agreement reportedly restricting DOGE's access to Treasury was issued, but specifically provides 'read only' exemptions for Marko Elez (DOGE member at Fiscal Service and Treasury) and Thomas (aka Tom) Krause (DOGE member at Treasury),' it states. 'This access still poses an unprecedented insider threat risk.'
Elez previously worked for SpaceX, Musk's space company, and X, Musk's social media company. Elez resigned Thursday after The Wall Street Journal inquired with the White House about his connections to 'a deleted social-media account that advocated for racism and eugenics.' Elez did not immediately respond to a request for comment.
In a letter to Bessent on February 7, senator Ron Wyden of Oregon said that "Treasury's refusal to provide straight answers about DOGE's actions, as well as its refusal to provide a briefing requested by several Senate committees only heightens my suspicions,' and requested that Bessent provide the logs of Elez and any other DOGE-affiliated personnel regarding their access to the Treasury's systems.