Longtime GSA employee quits rather than give Musk ally access to Notify.gov
J. David Ake/Getty Images
By
Natalie Alms
The leader of the Technology Transformation Services at GSA wanted access to a text messaging platform for government agencies.
A government engineer at the General Services Administration quit Tuesday after being asked to give a political appointee associated with Elon Musk administrative access to the agency’s texting platform called Notify.gov, which helps government agencies send text reminders about benefit programs like Medicaid.
The head of GSA’s Technology Transformation Services — Thomas Shedd, a longtime Tesla alum — has been requesting administrative access to all components of the system without a clear reason for needing that access, according to an internal message from the GSA engineer viewed by Nextgov/FCW. The news was first reported by 404 Media.
Shedd “would be able to view all personally identifiable information (PII) moving through the Notify system, including phone numbers and variable data for members of the public,” the employee — who appears to have worked at the agency for the past decade — wrote.
The system includes information like the email addresses, phone numbers and IP addresses of those the government is contacting, according to its privacy impact assessment, which notes that “minimizing access” is part of the system’s security. Shedd currently doesn’t have access to the system, according to Will Powell, GSA’s acting press secretary.
With the access he’s requesting, the Tesla alum would both “be able to download and store this data without anybody else receiving a notification” and “be able to fully manage the access of others, including granting the same access to others or removing it from existing team members,” the employee who quit wrote.
“Granting the same access would, of course, grant the same ability to view and download PII,” they noted.
The GSA engineer wrote that Shedd hadn’t given a justification for the ask, and that “while we have suggested alternatives, such as read-only access, Thomas has continued to request full admin/root access.”
Shedd, who is also the agency’s deputy commissioner for the Federal Acquisition Service, has been asking for access to other systems as well, according to a current GSA employee who was not authorized to speak on the record. That includes the TTS Github repository, for example, according to that employee and internal agency communications viewed by Nextgov/FCW.
Powell, the agency’s acting press secretary, told Nextgov/FCW in a statement that “access ensures a detailed understanding of how the systems work so areas for optimization and efficiencies can be quickly identified.”
“Mr. Shedd is working with all appropriate GSA officials to ensure all established GSA protocols and policies are followed before he is granted access to a TTS system,” he said.
The request for root access to Notify.gov without reasoning behind it is unusual, the current GSA employee said, adding that the assumption is that Shedd would give access to more users.
GSA serves as a central repository for government real estate and contracting — the latter of which also has its own, sensitive data associated with it — in addition to providing tech services and platforms to other agencies, like Notify.gov.
Shedd’s request for access to the Notify.gov system — and the federal employee’s resignation over it — is the latest in a string of incidents where new Trump appointees or Musk associates working for the Department of Government Efficiency ask for access to sensitive government systems and government employees resign in response.
Political appointees typically don’t have the skills or time to be doing technical work in systems, although Shedd is a software engineer, said Noah Kunin, who formerly worked at GSA, in addition to the Consumer Financial Protection Bureau. He’s also recently been co-hosting a podcast focused on Musk oversight.
Giving higher-profile employees this level of access also has cybersecurity implications, since they’re already targets, noted Kunin, who also pointed to the legal implications of the move.
“If they do this without a written justification or by updating the security plan first, they are in violation of [the Federal Information Security Modernization Act] and have created, under the law, a security incident,” said Kunin.
“We also believe that this level of access for somebody outside of the product team is not contemplated by the system’s authority to operate. While it’s entirely possible to properly update the [system security and privacy plan] to add this sort of access using our established ATO process, we have been instructed to skip that process and place the system in non-compliance until access is remediated,” the GSA engineer wrote. “I don’t believe that I can operate a program and system without the ability to manage access to PII. As a result, I have submitted my resignation at GSA.”