Whistleblower: DOGE Siphoned NLRB Case Data

RE: 4

The current Attorney General's brother is running for a seat on the Board of Governors of the Washington, DC bar. It is expected that he will carry water for Trump and Bondi and impede any sort of disciplinary action the DC bar may dole out to any attorney working for Trump.

Yet another way Trump has his lackeys putting a thumb on the scale.

Russia and China run their goverment offices with their own Linux distributions for very long now.

That's why we have docx

apparently? JEDI and Wild and Stormy were two programs just from the DoD and NSA that were 20 billion USD.

AWS, Azure, Oracle, SUSE (via Rancher) and I am sure GCP all have confidential & classified (C/S/TS) clouds, as well as lower FedRAMP clouds to get that sweet sweet federal money.

Not sure what questions it raises, it has been a thing for decades.

What questions? All of the major cloud operators have government offerings too.

We’ve seen lots of posts about DOGE get killed. It’s not far fetched to think they are actively working to keep news like this off HN’s front page.

I mean I think it would be a fair assumption that there’s a very very real chance that havinng worked at DOGE will come with credible threats to your safety in the future. This is a team that is currently in the process of killing peoples grandparents by cutting them off from social security, building databases of immigrants and people with autism among a million other fuckups.

People aren’t going to just let that slide. I really don’t think they should expect to live in comfort and anonymity for the rest of their days if you look at how these kinds of things have played out historically with only a few counterexamples (I.e the East German Stasi come to mind as one)

Maybe they list it as "Consulting" and list vague achievements in government cybersecurity auditing?

A bunch of them seem young enough to just leave it off and say they were in school. Maybe DOGE counts as a student cybersecurity project?

Oh, I'm sure some companies admire the "move fast, break things, don't care who you hurt, just follow orders" ethos.

Not at all: it says DOGE appears to have created a container in a place where containers were never created by NLRB. Tell THAT to someone who doesn't know what Docker is, and it is less informative.

Where's the technical ignorance?

From the email shown in the photo, it seems like DOGE was trying to build and run a docker container using Integuru (YC W24) https://news.ycombinator.com/item?id=41983409 to scrape the system

Editorialized by the reporter, not the original report.

No it’s malicious

They intentionally turned off logging. Only attackers and criminals do that.

It's just docker containers. As a technical person I was confused reading that at least 3 times until I made the mental connection that it's docker containers. So yes you are right it's made to sound more opaque and nefarious than one would normally assume in our field. If they have a policy that says we can't run docker containers in network A or zone B then just say so but don't lie to make it sound like Russia Hackers. That's the kind of shit that makes fence sitters and reasonable people across the isle not trust your motives.

Anywho, this whole "opaque" or "untrusted" code running in a VM is the same lingo that big corporates use to gatekeep newer technologies that bypass traditional processes. E.g. "oh sorry you can't test locally because you need to use our officially licensed and expensive Oracle DB instance. Oh and BTW, you can't use the free container image that Oracle provides free of charge. It's running 'untrusted' code in our network." and endless variations of that.

[dead]

Huh, I've never seen "active" before, it looks like one of the hidden views like pool. Can't blame people for not seeing a thread there...

I hope not. It would be such a disappointment.

Dang and other editors manually tweak things regularly to make sure stuff like this is not on the front page and consider that to be a feature not a bug and are not at all interested in listening to any criticism that maybe that’s not the right move in 2025.

You guys!

Paul Graham (the only "thought leader" behind this website) loudly campaigns against the current U.S. administration almost every day on Twitter.

One YC-backed founder out of more than 10,000 is volunteering with DOGE.

A more thorough response to this trope can be found here:

https://news.ycombinator.com/item?id=43734897

PG is a tech billionaire and I don't trust any of them more than I can throw them. They'll put on a nice "Don't be evil" face and then smash us under their heels.

The faq says rankings can be affected by automated moderation. I'd appreciate to have this clarified by a mod if one happens to read my words. Thanks

How are stories ranked?

The basic algorithm divides points by a power of the time since a story was submitted. Comments in threads are ranked the same way.

Other factors affecting rank include user flags, anti-abuse software, software which demotes overheated discussions, account or site weighting, and moderator action.

You guys! No topic has been anywhere near as heavily discussed this year on HN:

https://hn.algolia.com/?dateEnd=1745332080&dateRange=custom&...

I could stand in the middle of 5th Avenue and shoot somebody and I wouldn't lose voters.

I’ve been noodling this argument ever since November, and I am pretty confident now that America has a fragile, asymmetric information economy.

Most Americans on the right live in a protected information market. I am not talking about media bias — both sides have that. The issue is deeper: on the right, the marketplace of ideas has been captured. There's no free trade between ideas, only ‘subsidized’ narratives and ‘tariffs’ on dissent. That’s how Trump — or anyone like him — thrives. Realists, by contrast, get priced out.

This isn’t culture war stuff, this is structural failure. The traditional metaphor of American free speech — the Holmesian "marketplace of ideas" — breaks down when one side captures the market.

There is no competition of ideas when there is no fair fight.

If you’ve got a couple of million bucks to spend, my guess is start buying up and supporting local news channels in the rust belt, and then let them work on whatever they want to work, as long as they can show actual independence.

Or perhaps gift people subscriptions to things like groundnews or something. I don’t know if theres any science that shows it effectively diversifies information consumption of its users.

I don’t know what the napkin math is for a tipping point, but I suspect its not as expensive as litigating an entire administration.

Yet he literally can't get existing laws to be policed and acted on by government officials. Hardly absolute power when judges brush off his work left right and center.

I'm not so sure. Look at the bargaining power in geopolitics a country gets, when they know a certain country hacked them (Dem. hacks, Clinton email hacks, by Russia). It is always better to hide your tracks or to blaim someone else. Especially if it can be done easily.

They don't care, and also, their expectation from DOGE was probably "Logging is turned off, here's the credentials, go".

If one is using roaming, does it show the IP of locality they are actually in or the IP assigned to their home operator? I vaguely remember that it's the latter.

>Why would you assume Ruzzian Intelligence if only IP address has been mentioned?

because they have a theoretical capability to get the credentials that were being used and would love to have a database dump to figure out what to do with it later. The botnet explanation is also plausible, but not mutually exclusive.

DOGE people were brand new to the infrastructure. (That's one of the criticisms - they're doing all this wild activity without really understanding the environment they're working in.) So they very plausibly would not know about the region-restricting firewall.

And then, they tried to get it shut off as soon as they found out it existed.

Right because they got caught before and the Supreme Court and the right side of the aisle bailed him out time and time again

As a technical problem to correlate # bytes @ time is just a very simple and you don't need a PhD to solve. Its a matter of how many measurement points on the network you have available.

Having said that. I doubt they checked and who cares where it landed? Its out.

Occam's Razor on doge (and the admin as a whole) points to opportunist amateurs, fraternizing on bravado & loyalty while willing to entertain treason by jumping through hoops for why it can't bother them.

Looking for deeper layers is a distraction. Nostalgic even.

I can empathize.

Something worth knowing is that "attribution" is extremely difficult.

Also "attribution engineering" is really quite easy and difficult to see through.

Often the purpose of a hack is not to exfiltrate data or sabotage systems but is exactly to direct blame (or sometimes distract/misdirect)

Indeed in vault 5 of Snowden's NSA leaks an "attribution engineering toolkit" was a interesting find. Malware is almost always engineered to throw forensic investigators off the scent.

That all said, I think this incident happening in US gov, in the current climate, without immediate urgent investigation is scandalous and in itself an indicator of deeper and very serious skulduggery.

Not really. I am not a doge supporter, but if was and I wanted to troll the left, I would route traffic through a rented vps with a Russian IP.

It’s possible to route traffic such that assuming the crypto is perfect, the actual vps is not able to decrypt data.

I also think that it I were a doge member and _wanted_ to leak data to Russia, this is the exact opposite of how I’d go about doing it.

Assuming the policy wasn't known and it wasn'teant to be seen. But either way... Backdoors in bleb starlink access points surreptitiously added to the roof of the gsa, how would you ever begin to undo this level of compromise?

Yes, with a residential/mobile proxy. Russian proxies are cheap because they're blocked or heavily scrutinized by many interesting networks, due to the rampant and unpunished misbehavior of some people in Russia.

Would it make any sense at all for a government agency (DOGE) to buy shady residential proxies in order to log in to their super-admin accounts? No. Nearly every government bans foreign IP addresses from accessing internal systems. That leaves the question: why did that log-in attempt happen? There may be another explanation, but the only thing that comes to mind is that someone in Russia using a mobile internet connection tried to log in but forgot to enable his VPN before doing so.

I don't see a legitimate reason to require no logging either. If you're investigating things, you want your activities logged in a way you can't alter because it demonstrates how you found the evidence, and that you aren't just making things up.

The IP is mentioned in the article. It belongs to a cell provider. Technically possible to have a VPN endpoint on a cell network, but unlikely.

Why would a representative of a US government agency use a Russian VPN with legitimate, freshly created login credentials? I'm confident this is against all the cybersecurity rules in place.

I also don't understand why the HN comment section is full of people trying to make excuses or explanations.

It's pretty new, yes. The binding operational directive from CISA only came down in December. Agencies are in the midst of running the assessment tools and implementing the changes right now. See here: https://www.cisa.gov/news-events/directives/bod-25-01-implem....

Yes, a limit of eight. Meaning that if there were more than eight across the agency, the rest were supposed to be removed by order of CISA. So the binding operational directive is a plausible, alternate explanation of the facts reported in the article. Again, I didn't just do a google search and come up with this; the Deputy CIO specifically mentioned SCuBA in the email that's put in the article. It's not my fault that neither Krebs (nor anyone else, apparently) decided to look into what the email meant by "SCUBA."