GAO Undercover Test: Army Released a Service Member's Records With Personal Data Unredacted; Navy Had One Employee Handling FOIA Requests

Investigators for the Government Accountability Office posed as an outside requester and asked the military for service members' personnel records 26 times, and in one case the Army handed over records containing personal information that should have been redacted, according to a GAO report released Friday.

The report, GAO-27-107784, "Service Member Records: DOD Needs to Address Improper and Delayed Releasing of Personnel and Health Information," is dated Oct. 16, 2026, and was written for the House Armed Services Committee. GAO, the investigative arm of Congress, also found that the military services reported 49 breaches involving personal information over five fiscal years, and that at the time of its review a single employee was processing all Freedom of Information Act requests at Navy Personnel Command.

What GAO's Covert Test of Service Member Records Found

Posing as a fictitious nongovernmental requester, such as a private attorney, GAO sent 26 FOIA and Privacy Act requests for service member records to the five military services. Some of the forms deliberately contained flaws, incorrect or missing information that GAO said should have led to a denial or a request for more information.

The services approved three requests. Two were FOIA requests with no flaws, and GAO said the Marine Corps was right to approve them. The third was approved by the Army in response to a submission that "intentionally contained missing details." GAO said that request should have been denied or sent back for the missing information, and "the Army provided us with personally identifiable information that should have been redacted."

Three other requests were denied because of the deliberate flaws. For the remaining 20, GAO received either a response with no decision or no response at all. GAO received 18 responses within the 20-day time frames that apply to FOIA requests and, generally, to Privacy Act requests. For eight requests, it received no decision, no acknowledgment and no request for more information, which the report says the law and DOD guidance require.

GAO's summary describes the result as one improper release among "the 18 processed requests." The report notes the test was nongeneralizable, meaning the results cannot be projected to all records requests.

49 Breaches, More Than 1,000 Service Members

From fiscal 2021 through fiscal 2025, the services' personnel centers processed more than 390,000 FOIA and Privacy Act requests and reported 49 breaches involving the improper release of personally identifiable information, according to the report. The Air Force, whose figures include the Space Force, reported 24. The Navy reported 17, the Army 8 and the Marine Corps none.

GAO said the breaches affected more than 1,000 service members. Because the services report breaches themselves, "these figures may understate the actual number of incidents," the report says. Of the 49, 44 listed failure to follow policy or human error as the cause. Navy officials told GAO that 15 of the Navy's 17 involved personal information sent through unsecure email rather than releases in response to records requests.

The report also describes an Air Force audit started after the service learned of an improper release in October 2022. The audit found that the military records of 11 people, "including two members of Congress and several congressional candidates," had been released without proper authority. GAO said some of the information was related to a sexual assault. After that breach, the Air Force added another reviewer to make sure released records were properly redacted, the report says.

In a separate case cited by GAO, the National Archives' National Personnel Records Center in June 2025 released a member of Congress's comprehensive military record, including the Social Security number and date of birth, when only information public under FOIA should have gone out.

One Navy Employee for FOIA Requests

At the time of GAO's review, all FOIA requests at Navy Personnel Command were handled by one federal civilian employee, after a senior official who helped with the work retired and the Navy had no plans to replace that person. Navy data showed the average time to process a FOIA request rose from 1.64 days in fiscal 2018 to 55.5 days in fiscal 2024 and 77.4 days as of July 2025.

Officials said the staffing gap contributed to delays, a backlog and litigation. In 2025, the Navy's FOIA office had four lawsuits related to processing third-party requests, according to the report. Navy Personnel Command hired an assistant in late December 2025, and as of April 2026 Navy officials said a backlog-reduction plan was in place using the two employees plus reserve officers and other internal help.

Other services reported shortfalls too. In March 2025, the Army's personnel center had 16 unfilled positions in its records department. At the Air Force, one attorney processes all nongovernmental requests after three civilian attorneys retired under DOD's Deferred Resignation Program, according to officials.

Across the department, DOD spent nearly $500 million processing more than 266,000 FOIA requests from fiscal 2020 through fiscal 2024, including $21 million on litigation over FOIA lawsuits, GAO found.

Health Records and GAO's Five Recommendations

On health records, GAO said the Defense Health Agency handles requests for the 9.5 million service members, retirees and beneficiaries it serves at 547 military medical facilities worldwide, and that staff must search several new and legacy computer systems, and sometimes paper files, to assemble a complete record. Officials told GAO that redaction can be the most cumbersome part of the job. DOD has not assessed its current framework and systems for processing health records requests to find ways to streamline them, the report says.

GAO made five recommendations. It called on the Army, Navy, Marine Corps and Air Force each to conduct a workforce planning analysis so that staffing for processing personnel records requests matches current and projected needs. It also recommended that DOD's health affairs office and the Defense Health Agency assess the systems used for health records requests to find improvements, "such as consolidating databases or using artificial intelligence."

What DOD Said

In written comments, "DOD stated it concurred with the recommendations but stated it had concerns related to the data used in the report, the scope of our review, and how our report characterized the department's governance structure," GAO wrote.

DOD said more than 90 percent of the breach incidents were low-risk administrative errors that caused no harm to individuals, and that the draft report mixed general administrative incidents with breaches that came directly from the FOIA and Privacy Act release process. GAO said it could not independently verify DOD's risk assessment, noted that by law the department must report all breaches regardless of risk level, and added language reflecting DOD's view.

DOD also asked GAO to match its figures to the department's annual FOIA reports to the Justice Department. GAO said those reports do not break out requests for all four services or limit them to third-party requests. Army officials told GAO that the timeliness and accuracy of its records processing "have recently stabilized" after changes to its processes and staff assignments.

In an email to TDFP, GAO said it had no additional statement beyond the report, and a GAO official confirmed that the agency received 18 of the 26 responses within the required time frames. Asked for comment, the Pentagon's press office referred TDFP to the GAO report and its "Agency Comments" section and said it had nothing additional to share.

Sources: GAO-27-107784, "Service Member Records: DOD Needs to Address Improper and Delayed Releasing of Personnel and Health Information" (Oct. 16, 2026): https://www.gao.gov/products/gao-27-107784 ; full text: https://files.gao.gov/reports/GAO-27-107784/index.html