GSA left sensitive information in its Google Drive exposed, watchdog finds

MalBot · October 29, 2026, 12:15pm

The General Services Administration did not effectively protect physical security, personally identifiable data and general proprietary business information stored within its Google Drive, according to an <a href=“https://www.gsaig.gov/sites/default/files/audit-reports/A250043-1%20Final%20Report%20Redacted.pdf”>audit released Tuesday</a> by the agency’s Office of Inspector General.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

In a limited search of GSA’s Google Drive, the OIG found 116 files containing controlled unclassified information, or CUI, that were improperly shared with employees and contractors who did not have a legitimate business reason to know those details. The exposed data included Social Security numbers, phone numbers, proprietary research, vendor proposals and site plans for a Washington, D.C. building.

GSA IT’s review determined that the identified documents were “not exposed externally” and found “no indication of malicious intent,” according to a response letter from David Shive, GSA’s chief information officer.

The watchdog attributed the improper exposure of sensitive information to “deficiencies” in GSA’s oversight.

The OIG said the agency did not effectively manage a third-party data loss prevention tool, used to prevent and detect CUI exposures.

That tool searches documents shared in GSA’s Google Drive for CUI-related keywords or phrases. If the tool detects CUI, it performs a “pre-designed response,” which could include restricting access to the document, flagging the document to GSA’s Security Operations and Engineering Division and sending an automated email to the document owner, according to the OIG audit.

But GSA did not fully complete annual reviews of the tool’s search terms to ensure it detected CUI and did not incorporate “many relevant terms” from agency guidance into tool searches, the watchdog concluded. Tool searches also failed to detect documents that included search terms.

GSA also did not implement a tool feature known as optical character recognition that could have prevented CUI exposures, did not document program decisions affecting CUI protection in the Google Drive and was not aware of the tool’s file size limit of 15 megabytes, OIG wrote.

In addition to mismanagement of the tool, OIG found GSA lacked an approval process for properly sharing sensitive information and a standard naming convention that could help prevent CUI exposures in its Google Drive.

The office gave GSA seven recommendations to prevent future CUI exposures:

<ul>
<li aria-level=“1”>Restrict access to all 116 CUI documents exposed in GSA’s Google Drive to only GSA users with a lawful government purpose for accessing them.</li>
<li aria-level=“1”>Identify and restrict access to other CUI documents not found through OIG’s audit.</li>
<li aria-level=“1”>Notify individuals affected by the exposed information in accordance with GSA policy.</li>
<li aria-level=“1”>Implement additional controls, such as an approval process for sharing CUI documents, a standard naming convention for CUI documents and new agency training materials.</li>
<li aria-level=“1”>Improve management of the data loss prevention tool through annual search term reviews and use of CUI guidance terms.</li>
<li aria-level=“1”>Assess and implement new data loss prevention tool features, such as optical character recognition and methods to identify CUI documents larger than 15 megabytes.</li>
<li aria-level=“1”>Develop a process to document and maintain operational decisions for the data loss prevention tool.</li>
</ul>

Shive said GSA IT agrees with all of the recommendations and is “working on a plan to address them.”

He added that GSA IT took “significant corrective action to strengthen the protection of sensitive information across GSA’s Google Workspace” while OIG was conducting its audit.

Those actions included updating internal procedures, restricting access to documents shared domain-wide “as appropriate,” and evaluating additional controls and tools to flag CUI exposure. The agency also adopted the optical character recognition feature that OIG recommended be implemented, according to Shive’s letter.

The report released Tuesday is not the first time OIG has found that GSA did not adequately protect sensitive information stored on Google technology.

In August 2014, the office <a href=“https://nsarchive.gwu.edu/sites/default/files/documents/3469150/Document-05-Office-of-Inspector-General-General.pdf”>reported</a> that GSA did not protect information about child care centers, courthouses, water sources, building automation systems, security systems and fire alarm systems in its Google cloud computing environment. OIG issued additional reports between <a href=“https://www.gsaig.gov/sites/default/files/audit-reports/A140157.O.R.F15002%20-%20Reissuance%20-%20Personally%20Identifiable%20Inforrmation%20Unprotected%20in%20GSA’s%20Cloud%20Computing%20Environment.pdf”>2015</a> and <a href=“https://www.gsaig.gov/sites/default/files/audit-reports/A160096_1.pdf”>2017</a> that raised concerns about GSA’s ability to protect sensitive information within the Google environment.

In April 2025, the office <a href=“https://www.gsaig.gov/sites/default/files/audit-reports/A250043-2%20Final%20Alert%20Memorandum%20Redacted.pdf”>found</a> GSA’s Google Drive contained documents with sensitive information that users did not need to know, such as CUI, safety environmental management surveys and vendor financial information.

Article Link: GSA left sensitive information in its Google Drive exposed, watchdog finds - Nextgov/FCW