Rachel Maddow

And if these allegations are true, they suggest an apparently sort of a new sort of bucket, a new type of behavior from these guys that we are only learning about today thanks to a whistleblower in IT who has the technical skills to actually see what they're doing and who has now come forward to Congress and to the Office of Special Counsel, which protects whistleblowers.

He has come forward to explain something else that he believes these guys are doing that we didn't know before. And if he is right, it would seem to explain yet more about what previously seemed inexplicable. What he's describing is also something that seems very, very bad and very dangerous for our country. All right, so here's the story. NPR was first to break this story today.

He has come forward to explain something else that he believes these guys are doing that we didn't know before. And if he is right, it would seem to explain yet more about what previously seemed inexplicable. What he's describing is also something that seems very, very bad and very dangerous for our country. All right, so here's the story. NPR was first to break this story today.

Reporter Jenna McLaughlin publishing a more than 7,000-word piece, citing more than 30 sources. But the core of the story is based on a whistleblower disclosure from an IT staffer at the National Labor Relations Board named Daniel Barulis. And last month, Mr. Barula says that Doge staffers arrived at the headquarters of the National Labor Relations Board.

Reporter Jenna McLaughlin publishing a more than 7,000-word piece, citing more than 30 sources. But the core of the story is based on a whistleblower disclosure from an IT staffer at the National Labor Relations Board named Daniel Barulis. And last month, Mr. Barula says that Doge staffers arrived at the headquarters of the National Labor Relations Board.

He can't be positive they were from Doge, but whoever they were, he says they accessed National Labor Relations Board data systems for about a week. And then they deleted the accounts they had created in order to work in those systems. So they got in for about a week and then they deleted the accounts they had created to work inside those systems. Now, what's in those systems?

He can't be positive they were from Doge, but whoever they were, he says they accessed National Labor Relations Board data systems for about a week. And then they deleted the accounts they had created in order to work in those systems. So they got in for about a week and then they deleted the accounts they had created to work inside those systems. Now, what's in those systems?

Well, National Labor Relations Board has a lot of internal data that's really sensitive. The point of that agency is they adjudicate labor complaints at various companies. So their internal systems include a lot of really sensitive, proprietary data about U.S. companies and about their employees and about unions and about whistleblowers.

Well, National Labor Relations Board has a lot of internal data that's really sensitive. The point of that agency is they adjudicate labor complaints at various companies. So their internal systems include a lot of really sensitive, proprietary data about U.S. companies and about their employees and about unions and about whistleblowers.

It includes really sensitive stuff like witness testimony and legal information about ongoing cases. According to Mr. Barulis' disclosure, he believes Doge staffers took steps to make sure that whatever they did while they were inside the systems at the agency was not logged.

It includes really sensitive stuff like witness testimony and legal information about ongoing cases. According to Mr. Barulis' disclosure, he believes Doge staffers took steps to make sure that whatever they did while they were inside the systems at the agency was not logged.

So in the internal data systems of the agency, there were no traceable records of what they did inside the system because they configured their access to the system in ways that they could either manually or automatically remove traces of what they had done. But while they were in there, Mr. Barulis says there was a large exfiltration of data, a large exfiltration of data, almost all text files.

So in the internal data systems of the agency, there were no traceable records of what they did inside the system because they configured their access to the system in ways that they could either manually or automatically remove traces of what they had done. But while they were in there, Mr. Barulis says there was a large exfiltration of data, a large exfiltration of data, almost all text files.

And when I say it was a large exfiltration, to give you a sense of how unusual this was for the agency, this screenshot from Mr. Barulis' disclosure shows that large spike in outbound traffic leaving the agency and how unusual it was compared to normal activity on their systems.

And when I say it was a large exfiltration, to give you a sense of how unusual this was for the agency, this screenshot from Mr. Barulis' disclosure shows that large spike in outbound traffic leaving the agency and how unusual it was compared to normal activity on their systems.

He says the logs that should have shown what that was just attributed that large exfiltration of data to a deleted account. And he says the location where the data went had been obscured. There was no listing as to where the data went.

He says the logs that should have shown what that was just attributed that large exfiltration of data to a deleted account. And he says the location where the data went had been obscured. There was no listing as to where the data went.

Mr. Berulis then found that while these people were inside the system, this is worrying, they had disabled the core security systems that keep the agency's systems and data secure and private. Quoting from NPR, someone had disabled controls that would prevent insecure or unauthorized mobile devices from logging onto the system without the proper security settings.

Mr. Berulis then found that while these people were inside the system, this is worrying, they had disabled the core security systems that keep the agency's systems and data secure and private. Quoting from NPR, someone had disabled controls that would prevent insecure or unauthorized mobile devices from logging onto the system without the proper security settings.

There was an interface exposed to the public internet, potentially allowing malicious actors access to the NLRB's systems. Internal alerting and monitoring systems were found to be manually turned off, and multi-factor authentication was disabled. Now, why would these guys disable all the security on the system at this agency and then leave it that way when they got out? I don't know.