GSA left sensitive Google Drive files open to staff, contractors

The General Services Administration (GSA), a federal agency responsible for various operations such as contracting, procurement, and property management, has repeatedly left sensitive information accessible in its Google Drive, according to a report from the agency's Office of Inspector General (OIG). This issue has been a concern since at least 2014, with the OIG first reporting inadequate protection of controlled unclassified information (CUI) in GSA's Google cloud environment.

CUI refers to information that requires protection or restrictions on its distribution under federal laws, regulations, or policies. It can include physical security information, personally identifiable information (PII) of government employees, and proprietary business information. In this instance, the OIG found that approximately 2.5 million documents stored in the GSA's Google Drive contained CUI that was improperly shared with all GSA users.

During a limited search, the OIG discovered 116 files containing CUI that were improperly shared. The OIG raised concerns regarding GSA's failure to implement search terms, incomplete or undocumented annual reviews of search terms, and the lack of an optical character recognition feature that could help detect CUI in scanned documents. Additionally, the GSA was reportedly unaware of the file size limitation of 15 megabytes for the tool they had in place to prevent data loss and detect CUI exposures.

The exposed sensitive information includes site plans for government buildings in Washington, DC, which contain entrances, screening techniques, and locations of sensitive areas. Defense vulnerabilities and critical failure locations for buildings were also exposed. Furthermore, PII of government individuals, including social security numbers, addresses, dates of birth, and contact information, was found in improperly access-controlled files.

Proprietary business information, such as research and vendor proposals with technical and pricing details, was also exposed.

This lapse in data control is particularly concerning given that contractors with access to the GSA's Google Drive could potentially view proprietary information belonging to competing vendors, giving them an unfair advantage. The GSA has acknowledged the OIG's seven recommendations to fix the problems, but it remains unclear whether the corrective work has been completed. The OIG and GSA's office have not provided an update on the matter.