Summary

  • In an audit issued 27 October 2026, the General Services Administration’s inspector general found 116 files containing controlled unclassified information improperly shared with all GSA Drive users. That audience included employees and contractors without a business need for the material.
  • Fourteen of the 116 files exceeded the data-loss-prevention tool’s 15 MB scanning limit. Security managers told auditors they had not known about that limit until an April 2025 alert. The audit also found missed search terms, unused optical character recognition and no approval process for agencywide sharing.

The tool could not see its own edge

GSA management described a Drive holding about 2.5 million documents. Auditors did not inspect that entire collection. They ran a limited, judgmental search using 39 terms and focused on files shared to every GSA Drive user. The 116 they found are a documented exposure set, not a numerator for an agencywide exposure rate. Among them, 64 contained physical-security information. The report also identifies personal and proprietary business information. The public interest lies in the control failure, not in repeating the sensitive contents.

The agency had bought a detection tool. Its operators had not finished annual reviews of the terms that told the tool what to seek. Some exposed files containing active terms still escaped detection; other relevant terms never entered the search list. An available optical character recognition feature remained off. A 15 MB scan ceiling left 14 files in the audited set beyond that particular inspection path. In the separate 2025 alert, GSA said size had kept 10 of 15 previously exposed documents out of the scan. Those are two dated findings, not one rolling count.

The redacted final report finds a second gap before detection even begins: GSA had no approval process for sharing controlled information with all users and no standard naming convention to help flag it. A permission setting meant for collaboration became an agencywide distribution decision. The machine could only inspect what its terms, formats and size limit allowed; the institution had failed to govern both sides of that equation.

The inspector general made seven recommendations. They include restricting the 116 files, looking for other agencywide exposures, notifying affected people under policy, and changing the approval, naming, training and detection practices. GSA’s chief information officer agreed. The report records agreement, not completion. A dated, item-level access review and tested scanner configuration would establish what has been fixed since the audit. Until that receipt exists, “we have a tool” is a procurement fact, not a control result.

Sources