There was a problem locating the requested document.
Page 1
Case 1:25-cv-00596-ELH
Document 197
Filed 01/16/26
Page 1 of 7
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MARYLAND
AMERICAN FEDERATION OF STATE,
COUNTY AND MUNICIPAL
EMPLOYEES, AFL-CIO, et al., Plaintiffs, Case No. 1:25-cv-00596-ELH v.
SOCIAL SECURITY
ADMINISTRATION, et al., Defendants.
NOTICE OF CORRECTIONS TO THE RECORD
Defendant Social Security Administration (“SSA”) has reviewed records of and relating to data access of SSA’s former DOGE Team for audit and litigation purposes. Based on its review of records obtained during or after October 2025, SSA identified communications, use of data, and other actions by the then-SSA DOGE Team that were potentially outside of SSA policy and/or noncompliant with the District Court’s March 20, 2025, temporary restraining order (“TRO”) (ECF 48). SSA notified the undersigned Department of Justice (“DOJ”) attorneys on December 10, 2025, of its concerns. Following further diligence and review by SSA into these matters, which were necessary for SSA and the undersigned counsel to understand the facts surrounding the SSA DOGE Team’s actions, Defendants now respectfully notify the Court as follows. For the avoidance of doubt, undersigned counsel clarify that the information contained in this Notice was relayed to the undersigned counsel by SSA representatives. Counsel will promptly inform the Court if the information within their possession changes.
Page 2
Case 1:25-cv-00596-ELH I.
Document 197 Filed 01/16/26 Page 2 of 7 Clarification Regarding Timeframe of Compliance with TRO.
On March 24, 2025, SSA submitted a declaration executed by then-Commissioner Dudek to accompany Defendants’ Status Report and Certification of Compliance with the Court’s March 20, 2025, TRO. ECF 56, 56-1. Mr. Dudek stated in his Declaration: “As of Monday, March 24, 2025, SSA revoked all SSA DOGE Team members’ access to SSA systems containing personally identifiable information (PII) or systems of record[.]” ECF 56-1 ¶ 4 (footnote omitted). SSA believed that statement to be accurate at the time it was made. SSA has now determined that, during the morning (Eastern Time) of Monday, March 24, 2025, one member of the then-SSA DOGE Team ran PII searches on SSA’s copy of the Numident (SSA System of Records Notice 60-0058) within the Enterprise Data Warehouse (“EDW”), with the last search occurring on or about 9:30am ET. DOGE Team members’ access to all PII within SSA systems was terminated on or about Noon that same day on March 24, 2025, before the filing of the declaration at ECF 56.
II.
DOGE Team Member’s Possible Transmission of SSA PII to U.S. DOGE Temporary Organization Employee.
Mr. Dudek’s March 24, 2025, declaration also stated that: “The DOGE Defendants have never had access to SSA systems of record.” ECF 56-1 ¶ 4. SSA believed that statement to be accurate at the time it was made, and SSA believes it to be accurate today. However, SSA has determined that on March 3, 2025—three weeks prior to entry of the TRO—an SSA DOGE Team member copied Mr. Steve Davis, who was then a senior advisor to Defendant U.S. DOGE Temporary Organization, as well as a DOGE-affiliated employee at the Department of Labor (“DOL”), on an email to Department of Homeland Security (“DHS”). The email attached an encrypted and password-protected file that SSA believes contained SSA data. Despite ongoing efforts by SSA’s Chief Information Office, SSA has been unable to access the file to determine exactly what it contained. From the explanation of the attached file in the email body and based
Page 3
Case 1:25-cv-00596-ELH Document 197 Filed 01/16/26 Page 3 of 7 on what SSA had approved to be released to DHS, SSA believes that the encrypted attachment contained PII derived from SSA systems of record, including names and addresses of approximately 1,000 people. It is unclear if the password to access the file was shared with Mr. Davis or the DOL DOGE employee. Therefore, although it was and remains accurate that USDS has “never had access to SSA systems of record,” the March 3 communication sent to Mr. Davis contained data derived from SSA’s systems of record that Mr. Davis or the DOL DOGE employee could have accessed if provided the password.
III.
DOGE Team Members’ (Unused) PII Access During TRO.
SSA’s review identified an instance where SSA granted access to PII profiles to a DOGE Team Member after the TRO’s issuance, but the access granted was never utilized. Namely, on March 26, 2025, one DOGE Team member was granted access to ten EDW schema containing PII. This access was revoked on April 2, 2025. During the period the access was granted, the employee never used it to search and view any PII. Prior to this grant, SSA informed the employee about the TRO and its restrictions.
SSA’s review also identified that a DOGE Team member was granted access to a call center profile that allowed access to PII after the TRO’s issuance. This access was granted on April 9, 2025, and revoked on June 11, 2025. This profile is also used for non-PII call center metrics, and it is unknown at this time whether any PII was accessed. Prior to this grant, SSA informed the employee about the TRO and its restrictions.
IV.
Systems of Record to Which SSA DOGE Team Members Had Access.
On March 12, 2025, SSA submitted a declaration executed by SSA’s then-Chief Information Officer of the Office of the Chief Information Officer Russo, to accompany Defendants’ Opposition to Plaintiffs’ TRO Motion. At paragraphs 7 through 17, Mr. Russo described the SSA systems of record to which members of the SSA DOGE Team had been granted
Page 4
Case 1:25-cv-00596-ELH
Document 197
Filed 01/16/26
Page 4 of 7
access. SSA believed those statements to be accurate at the time they were made. SSA has now determined that the following additional systems access was in effect as of March 12, 2025, but terminated on or before March 24, 2025, at approximately Noon (Eastern Time), before the filing of the declaration at ECF 56.
a. Three DOGE Team members were granted access to a system containing SSA employee records for agency personnel for workforce initiatives.
b. Two DOGE Team members were granted access to a system containing personnel access information to ensure terminated employees were unable to badge into the building or to access IT systems with their PIVs.
c. Six DOGE Team members were granted access to shared workspace that would have allowed DOGE Team members to share data to which the employees had separately been granted access for fraud or analytics reviews.
d. Two DOGE Team members had access to a data visualization tool that could connect to other data sources, which could provide access to PII.
e. Two DOGE Team members had access to additional EDW schemas beyond those reported as of March 12, 2025.
V. Scope of SSA DOGE Team’s Work.
Also in his March 12 declaration, Mr. Russo attested that, “[t]he overall goal of the work performed by SSA’s DOGE Team is to detect fraud, waste and abuse in SSA programs and to provide recommendations for action to the Acting Commissioner of SSA, the SSA Office of the Inspector General, and the Executive Office of the President.” ECF 36-1 ¶ 5; see also, e.g., id. ¶¶ 7(d), 7(e), 8–14. Further, in Defendants’ TRO Opposition (ECF 36), Defendants argued that the SSA DOGE Team had a need to access SSA records because “the DOGE Team exists under
Page 5
Case 1:25-cv-00596-ELH Document 197 Filed 01/16/26 Page 5 of 7 Executive Order 14,158 to modernize technology and to ‘maximize efficiency and productivity’” within SSA. SSA believed those statements to be accurate at the time they were made, and they are largely still accurate. However, SSA determined in its recent review that in March 2025, a political advocacy group contacted two members of SSA’s DOGE Team with a request to analyze state voter rolls that the advocacy group had acquired. The advocacy group’s stated aim was to find evidence of voter fraud and to overturn election results in certain States.1 In connection with these communications, one of the DOGE team members signed a “Voter Data Agreement,” in his capacity as an SSA employee, with the advocacy group. He sent the executed agreement to the advocacy group on March 24, 2025.
At this time, there is no evidence that SSA employees outside of the involved members of the DOGE Team were aware of the communications with the advocacy group. Nor were they aware of the “Voter Data Agreement.” This agreement was not reviewed or approved through the agency’s data exchange procedures. SSA first learned about this agreement during a review unrelated to this case in November 2025.
In late December 2025, SSA made two Hatch Act referrals to the U.S. Office of Special Counsel related to the activities described in this Section V.
VI.
Noncompliance with SSA Security Policies.
In the March 12, 2025, declaration submitted in support of Defendants’ Opposition to Plaintiffs’ TRO Motion, SSA’s then-Deputy Commissioner of Human Resources Felix-Lawson stated that the members of SSA’s DOGE Team had all completed Privacy and Ethics training. ECF 36-2 ¶ 13. Further, Ms. Felix-Lawson explained, “[e]ach of the detailee agreements contained 1 Email communications reviewed by SSA suggest that DOGE Team members could have been asked to assist the advocacy group by accessing SSA data to match to the voter rolls, but SSA has not yet seen evidence that SSA data were shared with the advocacy group.
Page 6
Case 1:25-cv-00596-ELH
Document 197
Filed 01/16/26
Page 6 of 7
terms clarifying that detailee must not make unauthorized disclosures of SSA information and that detailee must follow SSA rules and policies while working for SSA.” Id. ¶ 14. Further, in his March 12 declaration, Mr. Russo attested that, “SSA has IT safeguards to ensure no private or commercial servers have been integrated with SSA systems. SSA performs continuous network monitoring that includes identifying unauthorized devices. The agency further has extensive security layers in place ensuring access to all systems and records are controlled and tracked with appropriate profiling (e.g., employee, contractor, supervisor) of the user.” ECF 36-1 ¶ 22. SSA believed these statements to be accurate at the time they were made, and SSA believes them to be accurate today. However, SSA has learned that, beginning March 7, 2025, and continuing until March 17 (approximately one week before the TRO was entered), members of SSA’s DOGE Team were using links to share data through the third-party server “Cloudflare.” Cloudflare is not approved for storing SSA data and when used in this manner is outside SSA’s security protocols. SSA did not know, until its recent review, that DOGE Team members were using Cloudflare during this period. Because Cloudflare is a third-party entity, SSA has not been able to determine exactly what data were shared to Cloudflare or whether the data still exist on the server.
*** SSA and the undersigned counsel bring these matters to the Court’s attention to ensure full candor to the Court. A review of the SSA DOGE Team’s actions is ongoing, and SSA and the undersigned counsel will continue to ensure that the record and representations made to this Court are accurate.
Page 7
Case 1:25-cv-00596-ELH
Dated: January 16, 2026
Document 197
Filed 01/16/26
Page 7 of 7
Respectfully submitted, BRETT A. SHUMATE Assistant Attorney General Civil Division /s/ Elizabeth J. Shapiro ELIZABETH J. SHAPIRO Deputy Branch Director Civil Division, Federal Programs Branch /s/ Marianne F. Kies MARIANNE F. KIES /s/ Samuel Holt SAMUEL HOLT Trial Attorneys Civil Division, Federal Programs Branch United States Department of Justice 1100 L Street NW Washington, DC 20005 Marianne.F.Kies@usdoj.gov Samuel.Holt2@usdoj.gov Attorneys for Defendants
PDF Page 1
PlainSite Cover Page
PDF Page 2
Case 1:25-cv-00596-ELH
Document 197
Filed 01/16/26
Page 1 of 7
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MARYLAND
AMERICAN FEDERATION OF STATE,
COUNTY AND MUNICIPAL
EMPLOYEES, AFL-CIO, et al.,
Plaintiffs,
Case No. 1:25-cv-00596-ELH
v.
SOCIAL SECURITY
ADMINISTRATION, et al.,
Defendants.
NOTICE OF CORRECTIONS TO THE RECORD
Defendant Social Security Administration (“SSA”) has reviewed records of and relating to
data access of SSA’s former DOGE Team for audit and litigation purposes. Based on its review of
records obtained during or after October 2025, SSA identified communications, use of data, and
other actions by the then-SSA DOGE Team that were potentially outside of SSA policy and/or
noncompliant with the District Court’s March 20, 2025, temporary restraining order (“TRO”)
(ECF 48). SSA notified the undersigned Department of Justice (“DOJ”) attorneys on December
10, 2025, of its concerns. Following further diligence and review by SSA into these matters, which
were necessary for SSA and the undersigned counsel to understand the facts surrounding the SSA
DOGE Team’s actions, Defendants now respectfully notify the Court as follows. For the avoidance
of doubt, undersigned counsel clarify that the information contained in this Notice was relayed to
the undersigned counsel by SSA representatives. Counsel will promptly inform the Court if the
information within their possession changes.
PDF Page 3
Case 1:25-cv-00596-ELH
I.
Document 197
Filed 01/16/26
Page 2 of 7
Clarification Regarding Timeframe of Compliance with TRO.
On March 24, 2025, SSA submitted a declaration executed by then-Commissioner Dudek
to accompany Defendants’ Status Report and Certification of Compliance with the Court’s March
20, 2025, TRO. ECF 56, 56-1. Mr. Dudek stated in his Declaration: “As of Monday, March 24,
2025, SSA revoked all SSA DOGE Team members’ access to SSA systems containing personally
identifiable information (PII) or systems of record[.]” ECF 56-1 ¶ 4 (footnote omitted). SSA
believed that statement to be accurate at the time it was made. SSA has now determined that,
during the morning (Eastern Time) of Monday, March 24, 2025, one member of the then-SSA
DOGE Team ran PII searches on SSA’s copy of the Numident (SSA System of Records Notice
60-0058) within the Enterprise Data Warehouse (“EDW”), with the last search occurring on or
about 9:30am ET. DOGE Team members’ access to all PII within SSA systems was terminated
on or about Noon that same day on March 24, 2025, before the filing of the declaration at ECF 56.
II.
DOGE Team Member’s Possible Transmission of SSA PII to U.S. DOGE
Temporary Organization Employee.
Mr. Dudek’s March 24, 2025, declaration also stated that: “The DOGE Defendants have
never had access to SSA systems of record.” ECF 56-1 ¶ 4. SSA believed that statement to be
accurate at the time it was made, and SSA believes it to be accurate today. However, SSA has
determined that on March 3, 2025—three weeks prior to entry of the TRO—an SSA DOGE Team
member copied Mr. Steve Davis, who was then a senior advisor to Defendant U.S. DOGE
Temporary Organization, as well as a DOGE-affiliated employee at the Department of Labor
(“DOL”), on an email to Department of Homeland Security (“DHS”). The email attached an
encrypted and password-protected file that SSA believes contained SSA data. Despite ongoing
efforts by SSA’s Chief Information Office, SSA has been unable to access the file to determine
exactly what it contained. From the explanation of the attached file in the email body and based
2
PDF Page 4
Case 1:25-cv-00596-ELH
Document 197
Filed 01/16/26
Page 3 of 7
on what SSA had approved to be released to DHS, SSA believes that the encrypted attachment
contained PII derived from SSA systems of record, including names and addresses of
approximately 1,000 people. It is unclear if the password to access the file was shared with Mr.
Davis or the DOL DOGE employee. Therefore, although it was and remains accurate that USDS
has “never had access to SSA systems of record,” the March 3 communication sent to Mr. Davis
contained data derived from SSA’s systems of record that Mr. Davis or the DOL DOGE employee
could have accessed if provided the password.
III.
DOGE Team Members’ (Unused) PII Access During TRO.
SSA’s review identified an instance where SSA granted access to PII profiles to a DOGE
Team Member after the TRO’s issuance, but the access granted was never utilized. Namely, on
March 26, 2025, one DOGE Team member was granted access to ten EDW schema containing
PII. This access was revoked on April 2, 2025. During the period the access was granted, the
employee never used it to search and view any PII. Prior to this grant, SSA informed the employee
about the TRO and its restrictions.
SSA’s review also identified that a DOGE Team member was granted access to a call
center profile that allowed access to PII after the TRO’s issuance. This access was granted on April
9, 2025, and revoked on June 11, 2025. This profile is also used for non-PII call center metrics,
and it is unknown at this time whether any PII was accessed. Prior to this grant, SSA informed the
employee about the TRO and its restrictions.
IV.
Systems of Record to Which SSA DOGE Team Members Had Access.
On March 12, 2025, SSA submitted a declaration executed by SSA’s then-Chief
Information Officer of the Office of the Chief Information Officer Russo, to accompany
Defendants’ Opposition to Plaintiffs’ TRO Motion. At paragraphs 7 through 17, Mr. Russo
described the SSA systems of record to which members of the SSA DOGE Team had been granted
3
PDF Page 5
Case 1:25-cv-00596-ELH
Document 197
Filed 01/16/26
Page 4 of 7
access. SSA believed those statements to be accurate at the time they were made. SSA has now
determined that the following additional systems access was in effect as of March 12, 2025, but
terminated on or before March 24, 2025, at approximately Noon (Eastern Time), before the filing
of the declaration at ECF 56.
a. Three DOGE Team members were granted access to a system containing SSA
employee records for agency personnel for workforce initiatives.
b. Two DOGE Team members were granted access to a system containing personnel
access information to ensure terminated employees were unable to badge into the
building or to access IT systems with their PIVs.
c. Six DOGE Team members were granted access to shared workspace that would
have allowed DOGE Team members to share data to which the employees had
separately been granted access for fraud or analytics reviews.
d. Two DOGE Team members had access to a data visualization tool that could
connect to other data sources, which could provide access to PII.
e. Two DOGE Team members had access to additional EDW schemas beyond those
reported as of March 12, 2025.
V. Scope of SSA DOGE Team’s Work.
Also in his March 12 declaration, Mr. Russo attested that, “[t]he overall goal of the work
performed by SSA’s DOGE Team is to detect fraud, waste and abuse in SSA programs and to
provide recommendations for action to the Acting Commissioner of SSA, the SSA Office of the
Inspector General, and the Executive Office of the President.” ECF 36-1 ¶ 5; see also, e.g., id.
¶¶ 7(d), 7(e), 8–14. Further, in Defendants’ TRO Opposition (ECF 36), Defendants argued that the
SSA DOGE Team had a need to access SSA records because “the DOGE Team exists under
4
PDF Page 6
Case 1:25-cv-00596-ELH
Document 197
Filed 01/16/26
Page 5 of 7
Executive Order 14,158 to modernize technology and to ‘maximize efficiency and productivity’”
within SSA. SSA believed those statements to be accurate at the time they were made, and they
are largely still accurate. However, SSA determined in its recent review that in March 2025, a
political advocacy group contacted two members of SSA’s DOGE Team with a request to analyze
state voter rolls that the advocacy group had acquired. The advocacy group’s stated aim was to
find evidence of voter fraud and to overturn election results in certain States.1 In connection with
these communications, one of the DOGE team members signed a “Voter Data Agreement,” in his
capacity as an SSA employee, with the advocacy group. He sent the executed agreement to the
advocacy group on March 24, 2025.
At this time, there is no evidence that SSA employees outside of the involved members of
the DOGE Team were aware of the communications with the advocacy group. Nor were they
aware of the “Voter Data Agreement.” This agreement was not reviewed or approved through the
agency’s data exchange procedures. SSA first learned about this agreement during a review
unrelated to this case in November 2025.
In late December 2025, SSA made two Hatch Act referrals to the U.S. Office of Special
Counsel related to the activities described in this Section V.
VI.
Noncompliance with SSA Security Policies.
In the March 12, 2025, declaration submitted in support of Defendants’ Opposition to
Plaintiffs’ TRO Motion, SSA’s then-Deputy Commissioner of Human Resources Felix-Lawson
stated that the members of SSA’s DOGE Team had all completed Privacy and Ethics training. ECF
36-2 ¶ 13. Further, Ms. Felix-Lawson explained, “[e]ach of the detailee agreements contained
1
Email communications reviewed by SSA suggest that DOGE Team members could have been
asked to assist the advocacy group by accessing SSA data to match to the voter rolls, but SSA has
not yet seen evidence that SSA data were shared with the advocacy group.
5
PDF Page 7
Case 1:25-cv-00596-ELH
Document 197
Filed 01/16/26
Page 6 of 7
terms clarifying that detailee must not make unauthorized disclosures of SSA information and that
detailee must follow SSA rules and policies while working for SSA.” Id. ¶ 14. Further, in his
March 12 declaration, Mr. Russo attested that, “SSA has IT safeguards to ensure no private or
commercial servers have been integrated with SSA systems. SSA performs continuous network
monitoring that includes identifying unauthorized devices. The agency further has extensive
security layers in place ensuring access to all systems and records are controlled and tracked with
appropriate profiling (e.g., employee, contractor, supervisor) of the user.” ECF 36-1 ¶ 22.
SSA believed these statements to be accurate at the time they were made, and SSA believes
them to be accurate today. However, SSA has learned that, beginning March 7, 2025, and
continuing until March 17 (approximately one week before the TRO was entered), members of
SSA’s DOGE Team were using links to share data through the third-party server “Cloudflare.”
Cloudflare is not approved for storing SSA data and when used in this manner is outside SSA’s
security protocols. SSA did not know, until its recent review, that DOGE Team members were
using Cloudflare during this period. Because Cloudflare is a third-party entity, SSA has not been
able to determine exactly what data were shared to Cloudflare or whether the data still exist on the
server.
***
SSA and the undersigned counsel bring these matters to the Court’s attention to ensure full
candor to the Court. A review of the SSA DOGE Team’s actions is ongoing, and SSA and the
undersigned counsel will continue to ensure that the record and representations made to this Court
are accurate.
6
PDF Page 8
Case 1:25-cv-00596-ELH
Dated: January 16, 2026
Document 197
Filed 01/16/26
Page 7 of 7
Respectfully submitted,
BRETT A. SHUMATE
Assistant Attorney General
Civil Division
/s/ Elizabeth J. Shapiro
ELIZABETH J. SHAPIRO
Deputy Branch Director
Civil Division, Federal Programs Branch
/s/ Marianne F. Kies
MARIANNE F. KIES
/s/ Samuel Holt
SAMUEL HOLT
Trial Attorneys
Civil Division, Federal Programs Branch
United States Department of Justice
1100 L Street NW
Washington, DC 20005
Marianne.F.Kies@usdoj.gov
Samuel.Holt2@usdoj.gov
Attorneys for Defendants
7
Third party AI contribution in government documents
Possible
Document content is reproduced directly from government sources. Some filings in our database may themselves contain AI-generated content submitted by third parties to government agencies.
Back to 
