American Oversight sues SSA over unanswered DOGE data requests

By Amara Osei

A nonprofit watchdog sued the Social Security Administration on Wednesday after the agency produced no documents in response to its DOGE-related Freedom of Information Act requests. American Oversight’s complaint, filed in the U.S. District Court for the District of Columbia, seeks to compel release of records about the so-called Department of Government Efficiency’s handling of personal data.

The nonprofit watchdog’s investigation targets DOGE’s activities at SSA. The complaint concerns personally identifiable information, or PII, belonging to the public and recounts whistleblower disclosures, court filings and reporting about DOGE’s presence during the early days of the second Trump administration.

What records is American Oversight seeking?

The watchdog seeks emails between senior SSA officials and several DOGE associates. It also seeks emails and texts mentioning the Master Death File, “god-level” access, thumb drives and other related terms.

Four disclosure threads underpin the case. Each concerns a different route by which DOGE personnel or associated systems allegedly handled Social Security data.

• Former SSA Chief Data Officer Charles Borges filed a complaint alleging that DOGE representatives uploaded a copy of the Numident database to a cloud server without following standard security protocols, contrary to agency policy.
• A Department of Justice court filing from earlier this year revealed potential exposure of PII through DOGE’s use of a third-party server.
• The same filing detailed coordination between DOGE and an advocacy group seeking evidence of voter fraud.
• An SSA inspector general report highlighted a whistleblower complaint in which a former DOGE software engineer allegedly told coworkers that he had put Numident and Master Death File data on a thumb drive and planned to share it with his new employer.

The accounts span cloud infrastructure, an outside server and removable media. They remain allegations and investigative disclosures, not a court finding that a breach occurred.

Why is access to the records disputed?

“Americans hand over their most sensitive personal information to the federal government because they have to, and they have every right to expect that information will be protected,” American Oversight executive director Chioma Chukwu said. “Instead, the Trump administration gave DOGE access to that information, and we’re now learning about serious failures to safeguard it.”

Chukwu’s case concerns more than a delayed response to a public-records request. The watchdog says the requested communications could show which officials and DOGE associates handled sensitive information, what actions followed and whether the material remains exposed.

Chukwu said: “The people who stand to pay the price aren’t the officials who made these decisions. They’re working families, retirees, and everyday Americans who could face identity theft, financial fraud, or threats to the benefits they’ve earned. Enough is enough.

“The American people deserve to know who had their information, what was done with it, and whether it’s still at risk. We’re going to court to find out.”

The complaint therefore joins two allegations: improper access to data and inadequate production of records about that access. The requested emails and messages remain undisclosed because SSA has not produced them.

What does the lawsuit seek to resolve?

American Oversight asks the federal court to compel SSA to release the documents. Its requests cover official emails, messages with DOGE associates and communications using terms tied to the Master Death File, elevated access and thumb drives. The case does not announce how much personal information was exposed, who accessed it or whether the information remains at risk.

That last point matters. The legal issue is whether SSA must disclose records that could test the allegations; the court has not yet determined the merits of those allegations. If SSA produces the material, the documents could clarify the coordination, data movements and handling methods described in the complaint.

The suit also places disclosed coordination between DOGE and a voter-fraud advocacy group alongside the data-security claims. The Justice Department filing described that coordination, while separate disclosures concern cloud, third-party and employee-device handling.

For risk and compliance teams, the complaint connects three control paths—cloud storage, third-party servers and removable media—with a fourth issue: public-records governance. The test is which safeguards applied at each step.

The records could settle the central question: who accessed the data, what happened to it and whether it remains at risk.