Whistleblower org says DOGE may have caused 'significant cyber breach' at US labor watchdog

By Raphael Satter and AJ Vicens

WASHINGTON (Reuters) -A whistleblower complaint says that billionaire Elon Musk's team of technologists may have been responsible for a "significant cybersecurity breach," likely of sensitive case files, at America's federal labor watchdog. 

The complaint, addressed to Republican Senate Intelligence Committee Chairman Tom Cotton and his Democratic counterpart Mark Warner and made public Tuesday by the group Whistleblower Aid, draws on the testimony of Daniel Berulis, an information technology staffer at the National Labor Relations Board (NLRB).

The NLRB, a New Deal-era agency that is tasked with protecting workers' rights to organize and join unions, has for years been a target of America's corporate titans - including Musk - some of whom are now seeking to have the agency's powers declared unconstitutional. 

In an affidavit, Berulis said he had evidence that DOGE staffers were given extraordinarily sweeping access to the NLRB's systems, which house sensitive case files. He said that beginning in early March, logging protocols created to audit users appeared to have been tampered with, and that he had detected the removal of about 10 gigabytes worth of data from NLRB's network sometime thereafter.

Berulis told Reuters in an interview Tuesday that the data in question includes proprietary business information from competitors, union organization and unfair labor practice respondents and their claims, including private affidavits. 

"That kind of spike is extremely unusual because data almost never directly leaves NLRB's databases," Berulis said in his affidavit. 

A spokesperson for Musk's team - officially known as U.S. DOGE Service - didn't immediately return a message seeking comment. A message left with the NLRB also wasn't immediately returned, although NPR, which first reported the story, quoted an NLRB spokesperson as disputing Berulis' claims and saying there had been no breach. Cotton and Warner didn't immediately return messages seeking comment.

Berulis alleged in the affidavit that there attempted logins to NLRB systems from an IP address in Russia in the days after DOGE accessed the systems. He told Reuters Tuesday that the attempted logins apparently included correct username and password combinations but were rejected by location-related conditional access policies.  

Berulis' affidavit said that an effort by him and his colleague to formally investigate and alert the Cybersecurity and Infrastructure Security Agency (CISA) was disrupted by higher-ups without explanation.

As he and his colleagues prepared to pass information they'd gathered to CISA he received a threatening note taped to the door of his home with photographs of him walking in his neighborhood taken via drone, Andrew Bakaj, Whistleblower Aid's chief legal counsel, said in his submission to Cotton and Warner.

"Unlike any other time previously, there is this fear to speak out because of reprisal," Berulis told Reuters. "We're seeing data that is traditionally safeguarded with the highest standards in the United States government being taken and the people that do try to stop it from happening, the people that are saying no, they're being removed one by one." 

Bakaj declined to share the note with Reuters Tuesday. The FBI declined to comment. 

A message left with CISA wasn't immediately returned.

(Reporting by Raphael Satter; Editing by Aurora Ellis)