The General Services Administration (GSA) left blueprints showing access points to federal buildings, Social Security numbers and vendor pricing data open to every employee and contractor through its Google Drive sharing settings, the agency's inspector general found, Nextgov/FCW reported Thursday. The audit shows how a default "share with everyone" setting can quietly undo physical and data security at an agency that manages federal offices and courthouses.
What Happened
In a report dated Oct. 27, "Controlled Unclassified Information in GSA's Google Drive Was Improperly Exposed," the Office of Inspector General said a limited search of the roughly 2.5 million documents in GSA's Drive turned up 116 files of controlled unclassified information, sensitive material that is not classified but must be restricted, shared with all GSA users. They included site plans for a Washington, D.C., facility marking entrances and screening techniques, an analysis of a building's critical failure locations, and floor plans showing gun lockers and judges' chambers.
The finding concerns internal oversharing; the report does not say anyone outside the agency opened the files. Chief Information Officer David Shive wrote that GSA IT's review found the documents were "not exposed externally" and showed no sign of malicious intent, Nextgov/FCW reported.
Auditors blamed weak management of a third-party data loss prevention tool, software meant to spot and block sensitive files. GSA skipped full annual reviews of its search terms, did not turn on optical character recognition to read scanned documents and did not know the tool has a 15-megabyte file size limit.
Why It Matters
The inspector general first reported Google cloud exposures at GSA in August 2014 and again between 2015 and 2017, and issued an alert in April 2025 that included a vendor's full bank account number. A decade of repeat findings suggests that settings and scanning tools drift unless someone owns them. Any organization can check which files are shared domain-wide or by open link, confirm its scanners read images and large files, and require approval before sensitive material is shared broadly.
What to Watch
GSA agreed with all seven recommendations, including restricting the 116 files, finding other exposed material and notifying affected people. Shive said GSA IT is working on a plan to address them. Watch for the notifications and whether the inspector general's follow-up finds the fixes held.
