The Drive Everyone Could Open

The General Services Administration's own inspector general has found that sensitive information was exposed to all agency users on Google Drive. No breach, no outside actor, no sophisticated intrusion. The files were simply shared too broadly by default, and nobody caught it until the watchdog did.

The agency that writes the rules broke its own

GSA is not a peripheral federal office. It is the organisation that negotiates cloud contracts, sets technology procurement standards, and effectively tells other agencies how to buy and configure the tools they use every day. When its own inspector general finds sensitive data sitting open to every employee with an agency login, the irony is not subtle. This is the body meant to model good practice, and the audit shows the practice wasn't there.

The finding, reported by FedScoop, describes exposure to all agency users on Google Drive. That phrase alone tells you the shape of the failure. It wasn't a targeted leak to a specific group who shouldn't have had access. It was a default setting that made information visible to everyone inside the organisation, which in an agency the size of GSA means a very large number of people who had no reason to see it, no need to see it, and in many cases no idea the material was even sitting there.

There is a reason this particular agency's name on this particular finding carries extra weight. Other departments look to GSA's contracts and guidance as a baseline for what responsible cloud use looks like. A procurement officer in a smaller agency who wants to justify a sharing policy will often point upward, to what GSA itself does, as the reference point. That reference point just failed its own internal review.

Configuration, not intrusion

It is worth being precise about what this is and is not. This is not a hacking story. Nobody phished a credential, exploited a software vulnerability, or moved laterally through a network after gaining a foothold. The exposure existed because of how sharing permissions were set at the agency level, the kind of setting that gets established once, during a rollout, and then forgotten for years because nobody owns the job of revisiting it.

That is a less dramatic story than a breach, and it is also a far more common one. Cloud platforms like Google Drive are built to make sharing easy, and "easy" and "secure by default" are not the same design goal, however much vendors would like agencies to assume they are. An organisation that adopts these tools without a deliberate, revisited policy on who can see what is choosing convenience over control, whether or not anyone in the room intended to make that trade.

The inspector general's role here is exactly what it should be: finding the gap before it becomes a headline about a leak, rather than after one happens and the agency is explaining itself to Congress. That the gap existed at all inside GSA, of all agencies, is the part worth sitting with. This is not a small department without a security staff. It is the agency whose job includes telling other agencies how to do this properly.

It is also worth noting what the audit does not claim. There is no indication anyone exploited the exposure, no claim of data having left the building in a way investigators could trace to a specific bad actor. The finding is about risk that existed, not about confirmed harm that occurred. That distinction matters for how seriously it should be taken, not less seriously, because the entire point of an inspector general's audit is to catch risk before it turns into harm rather than after.

Defaults are policy, even when nobody chose them

There's a temptation to treat default settings as neutral, as though "that's just how the software works" absolves anyone of responsibility. It doesn't. A default that exposes sensitive information to an entire user base is a policy decision, made in practice by whoever configured the platform and ratified in practice by whoever never checked it afterwards. Silence is still a choice, and in this case it was a choice made repeatedly, every day the setting went unreviewed.

This is where the GSA case becomes instructive beyond its own walls. Any federal office running Google Drive, or any comparable shared storage platform, inherits the same risk the moment it stops asking who can see what and starts assuming the platform handles that for them. The platform doesn't handle it. The platform does what it's configured to do, and configuration is a human job that has to be repeated on a schedule, not a one-time setup task performed at launch and never revisited.

The inspector general's audit is a useful corrective precisely because it doesn't require a villain. There is no hacker to catch, no disgruntled insider to discipline, no foreign actor to attribute blame to in a press conference. There is only a setting that should have been narrower, sitting unnoticed until someone whose actual job was to notice finally looked at it closely enough to flag it.

That absence of a villain is exactly why this kind of story gets less attention than a breach does, and exactly why it deserves more. A breach makes for a clean narrative: attacker versus victim, cause and effect. A misconfigured default makes for a duller one: nobody did anything, which is itself the problem. Government oversight bodies are good at investigating the first kind of story. The harder discipline is building processes that catch the second kind before an inspector general has to.

What the finding actually asks for

The fix implied by this kind of audit is not glamorous and it will not generate a procurement contract or a product announcement. It is a review of sharing permissions across the agency, an audit of who currently has access to what, and a process for revisiting those settings on a fixed schedule rather than waiting for an inspector general to flag the problem again in a few years' time. None of that is exciting. It is maintenance, the least funded and least rewarded category of government IT work, and it is exactly what this exposure needed and evidently didn't get.

GSA will presumably narrow the permissions now that the finding is public and attached to its name. The harder question is whether the review that should happen next year, and the year after that, actually happens without another inspector general's report forcing it into existence. An audit is a one-time check, however thorough. The exposure it found was the product of nobody doing that check routinely for however long the setting had been wrong. Fixing the specific setting without fixing the absence of routine review simply resets the clock on the same mistake, waiting for the next audit to find it again.

That is the real lesson sitting underneath this story: the exposure wasn't caused by anyone doing something actively wrong so much as by everyone assuming someone else had already done something right. In an agency that sets technology standards for the rest of government, that assumption is the most expensive part of the whole finding, and the one least likely to be fixed by a single round of tightened permissions.