DOGE Associates Gained Access to $6 Trillion Treasury Payment System

What Happened

Beginning on Inauguration Day 2025, Elon Musk's DOGE placed associates inside the Treasury Department with access to the Bureau of the Fiscal Service — the payment system that processes over $6 trillion in annual federal payments. The system handles tax refunds, Social Security benefits, veterans' benefits, Medicare payments, and federal salaries, and contains the Social Security numbers and bank account information of hundreds of millions of Americans.

The DOGE Associates

Tom Krause, the former Chief Financial Officer and President of Broadcom Software and current CEO of the Cloud Service Group, was installed as an unpaid "senior advisor for technology and modernization" at Treasury. This gave him access to one of the most sensitive financial databases in the federal government through a temporary special government employee arrangement.

Marko Elez, a 25-year-old software engineer, began working as a Treasury employee on January 21, 2025. In a revelation that crystallized the recklessness of the access controls, Elez was discovered to have been mistakenly granted "write" access to a sensitive payments database — meaning he had the ability to alter payment records in a system that disburses trillions of dollars annually. Treasury officials said the write privilege was given by mistake and revoked after one day upon discovery.

Elez resigned on February 6 after the Wall Street Journal discovered racist social media posts he had made before joining DOGE, raising fundamental questions about the vetting process for individuals given access to the nation's financial infrastructure.

The Lawsuits

A coalition of 19 state attorneys general, led by New York AG Letitia James, sued the Trump administration alleging that DOGE was given unauthorized access to the payment system in violation of federal privacy laws. A separate lawsuit was filed by a group of union members and retirees.

On February 8, US District Judge Paul Engelmayer issued a preliminary injunction blocking DOGE access, describing the approach as "chaotic and haphazard" and finding a risk of "irreparable harm" to Americans whose data was exposed.

The Appeals Court Reversal

Despite the district court findings, the 4th Circuit Court of Appeals reversed course in August 2025. In a 2-1 decision, the panel vacated the injunction, with Trump-appointee Judge Julius Richardson writing that the lower court had "abused its discretion." The reversal gave DOGE access not only to Treasury payment systems but also to IRS systems containing comprehensive taxpayer information for virtually every American.

Legal Analysis

Privacy Act and FISMA Violations

The Privacy Act requires that access to personal records be limited to those with a legitimate need and proper authorization. The Federal Information Security Management Act (FISMA) mandates specific cybersecurity protocols for government systems. The chaotic access controls described by the court — including the accidental granting of write access — demonstrate failures under both statutes.

The Write Access Problem

The mistaken granting of write access to Marko Elez represents more than an administrative error. In a system that disburses $6 trillion annually, write access means the ability to alter payment records — to redirect payments, change amounts, or modify beneficiary information. Even if the error lasted only one day, it exposed the system to catastrophic risk and demonstrated that the access control framework was fundamentally inadequate.

Scope of Data Exposure

The Treasury payment system contains an extraordinary concentration of sensitive data: Social Security numbers, bank account and routing numbers, tax liability information, benefit payment histories, and federal salary records. Unauthorized access to this data enables identity theft, financial fraud, and political surveillance at a scale affecting virtually the entire American population.

Why This Is Classified Critical

• Scale of risk: $6 trillion in annual payments and financial data for hundreds of millions of Americans.
• Write access: A DOGE associate was mistakenly given the ability to alter payment records in the nation's central payment system.
• Inadequate vetting: An associate with racist social media posts was given access to critical financial infrastructure without adequate background screening.
• Judicial findings: A federal judge found the access "chaotic and haphazard" and identified a risk of "irreparable harm."
• Systemic vulnerability: The accidental nature of the write access error indicates that security controls were fundamentally insufficient for the sensitivity of the systems involved.
• Appellate reversal: Despite serious judicial findings of harm, the appeals court allowed access to continue, leaving the vulnerability unresolved.

International Law Violations

1. ICCPR Article 17: Mass unauthorized access to financial records constitutes arbitrary interference with privacy. The chaotic access controls and inadequate vetting compound the violation.
2. UDHR Article 12: The right to protection of the law against arbitrary privacy interference was undermined by both the initial access and the appellate court's decision to lift protections.