NLRB whistleblower claims Musk’s DOGE potentially caused significant security breach

Amna Nawaz:

Since President Trump reentered the Oval Office, billionaire Elon Musk and his DOGE team have been sweeping through federal agencies, accessing sensitive data as part of the effort to scale back the size of government.

We're getting new information about the scope of that access at one independent federal agency. That's the National Labor Relations Board, which protects workers' rights to organize and investigates unfair labor practices. A whistle-blower complaint filed by an I.T. staffer at the NLRB claims that DOGE gained access to closely guarded data, including case files, and that could have led directly to a — quote — "significant cybersecurity breach."

That whistle-blower, Daniel Berulis, joins me now, along with his lawyer, Andrew Bakaj.

Welcome to you both. Thanks for being here.

Daniel Berulis, National Labor Relations Board Whistle-Blower:

Thank you for having us.

Amna Nawaz:

So, Daniel, let's just start with you.

You had been at the agency for about under a year or so. It was about early March when the DOGE team arrived at the headquarters. When and how did you notice that something wasn't right, something was going on?

Daniel Berulis:

Sure.

I was doing metrics review, kind of looking around, trying to do optimization of our own, because we're always trying to save money. And we were identifying different things, and we noticed something that was off. Me and a couple of different people noticed different points, but it kind of added up to a bigger picture. They're called indicators of compromise in the private sector.

And so, when I noticed these indicators, red flags went off in my head, and I said, something's up here. So I investigated farther at that point.

Amna Nawaz:

And what did you find as you investigated further? What was happening to the data that you saw?

Daniel Berulis:

Sure.

At first, I didn't have a good picture, so I started to try to rule out possibilities of what benign could have caused these large exfiltration of data, could cause these large spikes of internal transfers.

Amna Nawaz:

Exfiltration of data, to be clear, you saw a large amount of data being moved out of the NLRB system; is that right?

Daniel Berulis:

That's correct, leaving a network interface that faces towards a public Internet, something that would only occur if you were to transfer a file outside of our secure system.

Amna Nawaz:

And that caught your attention why? I'm assuming that kind of thing doesn't usually happen?

Daniel Berulis:

It was very abnormal. There's a 200 or 300 percent increase in that time period as to what normal baseline is. So that's definitely unusual and warranted more investigation.

Amna Nawaz:

And in the affidavit, you say that you detected the removal of 10 gigabytes worth of data. Do you have any idea what kind of data we're talking about, why this would cause concern?

Daniel Berulis:

Sure.

So what that data spike correlated with was data that was transferred off of an internal record-keeping device that was only used for internal case data. So this system only has the private information about union organizers. The privileged business proprietary, technologies, competitors, those kind of things are in that system only. There's no other data. There's nothing else except that.

So that correlated data spike lined up in the exact time window and the same amount. And so that's what we can determine was taken, was data out of that system particularly.

Amna Nawaz:

So, Andrew, the White House responded to our request with a statement about this.

And they said — quote — "It's months-old news that President Trump signed an executive order to hire DOGE employees at agencies and coordinate data sharing. Their highly qualified team has been extremely public and transparent in its efforts to eliminate waste, fraud and abuse across the executive branch, including the NLRB."

So, Andrew, they're arguing this is all part of their work that they're doing to cut waste, fraud and abuse.

Andrew Bakaj, Attorney for Daniel Berulis: If the administration is taking the position that having data exfiltrated out of the United States government and potentially into other nation-states, if that's about efficiency and effectiveness for the nation, it doesn't make any sense.

Within 15 minutes of DOGE engineers creating accounts, years, names and passwords within internal systems within DOGE, within 15 minutes of the creation of those accounts, somebody or something from Russia tried to log in with all of our credentials, meaning they had the right usernames and right passwords.

And the question is, how do they get that and why? The second question that I have is that why is it that from what Dan has seen, as well as others, because we have spoken to other individuals who are able to corroborate this, which is that some of the data is also using Starlink as a backdoor.

And that's another way to get data out of internal databases within agencies. And Starlink has now direct access where information is likely, we believe is funneled directly into Russia.

Amna Nawaz:

So let me ask you, based on the evidence you have seen, do you have a view about why the DOGE team would have been accessing and exfiltrating, sending out all of this data?

Andrew Bakaj:

That I don't know. I don't want to speculate as to the why because there are so many questions that would — some questions that would lead to.

But that certainly is the question, is, why are they doing this? Now, part of it may be there's a component where this could be intentional. There's also a component where this is simply sloppiness. I mean, another thing that we have seen within databases within the government, as Dan will be able to talk about, is that internal databases throughout the government have been opened to the open Internet.

Daniel Berulis:

That's the key, is, these are not just my agency. These are Department of Treasury. These are Department of Energy, Department of Defense. So these are the critical systems that those agencies use that basically turn on the porch light for other foreign nation states to come on in.

Amna Nawaz:

And I need to ask you as well, Daniel, because the — Mr. Musk's own companies have face complaints at the NLRB. We know he brought just last year a case to federal court basically arguing that the agency's structure was unconstitutional, arguing it shouldn't exist in the first place.

Is there any way of knowing if the DOGE team accessed any information related to cases about Elon Musk?

Daniel Berulis:

One of the frustrating things about this is, there's been roadblocks introduced along the way.

One of the things I don't have is access to that level of data. Those logs and records of what was accessed during that time are missing, and just coincidentally missing after the data spike incident. No other period of time is missing except that small window.

Amna Nawaz:

Missing from your view? Do you know if other people have access to that?

Daniel Berulis:

They were deleted entirely.

Amna Nawaz:

You were able to confirm that?

Daniel Berulis:

Yes, I had another — yes, absolutely.

Andrew Bakaj:

Another key point to your question is that the data that was flying out of NLRB was case-related data. It was their internal case management system.

So, given the fact that an entire library or an entire…

Daniel Berulis:

Encyclopedia, yes.

Andrew Bakaj:

… encyclopedia worth of information has been flying out, is it plausible that that would include any of Elon Musk's corporate information? It's very possible. We don't know.

Amna Nawaz:

These are all questions you still have, but we don't have answers to.

Andrew Bakaj:

Correct. We don't have answers to that.

Amna Nawaz:

Can I ask you, Dan, big picture, was it an easy decision to come forward to say this publicly, to get a lawyer, to be a whistle-blower? Why decide to do that?

Daniel Berulis:

It was never a question whether or not to do the right thing. That was always my agenda. But how I did it or whether or not I did it, honestly, was absolutely a question. It's my safety. There's so much at play that I didn't realize too, but I'm standing behind it. I'm putting my name to it, and that's just who I am.

Amna Nawaz:

You mentioned your safety. Why do you mention that?

Daniel Berulis:

We had an incident. My — go ahead.

Andrew Bakaj:

This is a difficult topic for Dan to discuss, but prior to our filing the whistle-blower disclosure this week, last week, somebody went to Dan's home and taped a threatening note, a menacing note on his door with personal information.

Daniel Berulis:

While I was at work, yes.

Andrew Bakaj:

While he was at work, and it also contained photographs of him walking his dog taken by a drone. So…

Amna Nawaz:

This was on your front door to your home?

Daniel Berulis:

Taped straight on, not inconspicuous, just right there in a white envelope.

Andrew Bakaj:

You can't get any more direct — a direct threat than that.

Amna Nawaz:

Dan, you said this felt like the right thing to do. What do you want to see happen next?

Daniel Berulis:

Just a full investigation. That's all I have wanted, is just somebody to come in and validate, tell me why I'm wrong. Just come in and say, this is because of this.

And so far I have been unable to find that. Looked throughout my agency, tried to go outside of my agency, and that was not successful. I just want somebody to look at the data, look at what's happened. Find out. That's it.

Amna Nawaz:

Daniel Berulis, Andrew Bakaj, thank you to you both for being here.

Andrew Bakaj:

Thank you.

Daniel Berulis:

Appreciate you having us on.