GSA Left Building Security Plans and Social Security Numbers Open Agency-Wide Despite $7.8 Million Tool, Inspector General Finds

The General Services Administration left sensitive government information, including building security details and Social Security numbers, open to all of its employees and contractors in its Google Drive, the agency's Office of Inspector General said in a report released Tuesday. The audit also found that a software tool GSA has spent about $7.8 million on since 2014 to catch such exposures did not detect them.

GSA manages federal buildings and buys goods and services for much of the government. Its Google Workspace, used for collaboration across the agency, includes a Google Drive that holds about 2.5 million documents, according to the report.

What Was Exposed in GSA's Google Drive

Auditors searched the drive using 39 keywords taken from GSA's own guidance on controlled unclassified information, or CUI, and limited the search to documents shared with every GSA user. They found 116 files containing CUI that "were improperly shared with all GSA users," exposing the information to employees and contractors "who did not have a legitimate business need to know."

According to the report, the files included physical security information "such as counterterrorism methods, continuity of operations plans, and blueprints showing access points to sensitive areas of federal buildings"; personal information such as Social Security numbers and dates of birth; and proprietary business information, including vendor proposals with technical and pricing details.

The inspector general said its sample cannot be projected to the whole drive, but that "the volume of CUI found during our limited search indicates that more CUI may be exposed."

A $7.8 Million Tool With a Blind Spot

In August 2014, after an earlier audit, GSA installed a third-party data loss prevention tool that scans documents shared agency-wide for words and phrases linked to CUI. A GSA official told auditors the agency had spent about $7.8 million on the tool as of September 2026, the report says.

The audit found that GSA had not fully completed annual reviews of the tool's search terms, had left out many relevant terms from its own CUI guidance, and had not turned on an available optical character recognition feature. It also found GSA "was unaware of the tool's file size limitation of 15 megabytes." Searches with the tool failed to flag exposed documents that contained terms already on its list, according to the report.

A Problem Flagged Since 2014

The report says this is not the first warning. A 2014 alert found sensitive information about child care centers, courthouses, water sources and security and fire alarm systems available across the agency. A January 2015 report found that personal information of at least 907 employees, contractors and job applicants was exposed. Follow-up reviews in 2017 found GSA could not show it had notified the people affected. The inspector general issued two more alert memos on exposures in GSA's Google tools in April and October 2025.

The inspector general made seven recommendations, including restricting access to the 116 documents, searching for other exposed files, notifying affected people under GSA's breach notification policy, requiring approval before CUI is shared with all users, and finding ways to protect files larger than 15 megabytes. GSA's chief information officer agreed with the recommendations, according to the report.

Sources: GSA Office of Inspector General, "Controlled Unclassified Information in GSA's Google Drive Was Improperly Exposed," Report A250043/I/T/F27002 (Oct. 27, 2026): https://www.gsaig.gov/content/controlled-unclassified-information-gsas-google-drive-was-improperly-exposed ; full report (PDF): https://www.gsaig.gov/sites/default/files/audit-reports/A250043-1%20Final%20Report%20Redacted.pdf