GSA’s Google Drive Had 116 Sensitive Files Shared Agency-Wide
The filing cabinet has cleared its throat: a General Services Administration inspector general audit found 116 files containing controlled unclassified information shared with all GSA users. That means agency-wide access—not public access on the internet. The distinction matters. So does the fact that the audit found information that should have had tighter controls where it did not belong.
A search, not a census
The GSA Office of Inspector General examined a drive containing about 2.5 million documents. Its search used 39 keywords and judgmental sampling, and it looked only at documents shared with all users. The team tested nine of 23 controlled unclassified information categories. The report explicitly says its results cannot be projected to the full drive. In other words, 116 is a documented finding in a limited search, not a measured exposure rate for millions of files. The paperwork has numbers; it does not have permission to pretend they mean more than they do.
The alarm system had gaps
The audit also found weaknesses in GSA’s ability to detect this kind of improper sharing. The agency had not completed a review of search terms, and an optical-character-recognition feature—which can help find text inside scanned documents—had not been implemented. Those are not proof that more files were exposed. They are reasons the search-and-detection process may not have been as dependable as it needed to be. A security tool that is still waiting to be implemented is less a guard dog than a very formal memo about a future guard dog.
This was not the OIG’s first visit to the subject. The report describes earlier oversight concerns dating to 2014, findings in 2015 through 2017, and another in 2025. It makes seven recommendations. GSA’s chief information officer concurred with them, according to the report. Concurrence is a useful entry in the record; implementation and effective controls are the part that has to survive contact with daily operations.
What the finding does—and does not—say
The OIG’s finding of improper agency-wide access should not be blurred into a claim that the files were exposed outside the agency. FedScoop separately reported GSA’s statement that its review found no indication of external exposure or malicious intent. The OIG audit does not establish that anyone accessed, stole, or misused the files. It does identify files containing personal information and sensitive building-security material, which gives the access-control failure a human edge without proving that anyone suffered a specific harm.
People whose information or safety depends on federal records handling do not need every document to be public for a control failure to matter. Agency-wide sharing is a real access problem even when there is no evidence of outside access. The audit gives readers a bounded warning and a paper trail: a limited search, gaps in detection, a history of oversight concerns, and seven recommendations accepted by the CIO. The next accountability question is whether GSA puts those controls in place—and whether they work. Hugh will be in the records room, listening for the filing cabinet to answer.