Fed employee repeatedly removed sensitive files, watchdog finds
A Federal Reserve Board staffer mishandled sensitive classified files and triggered hundreds of data loss prevention alerts leading up to their retirement, the agency’s inspector general revealed in a new report.
The security issues with the employee were uncovered by the watchdog during its audit of the Fed’s offboarding process, which began in March 2025.
Four months into its examination, the OIG learned of an individual with the central bank’s Division of International Finance who announced plans to retire in July 2024 and expressed a “desire to remove files” before then.
The auditors were alarmed by that discovery and continued to pull the string, finding several more instances involving the employee — and what they said was an “apparent lack of diligence” by the Fed in resolving the issues.
In 2021, a review by the board’s Information Security Operations team found that the worker copied hundreds of Federal Open Market Committee files to an unencrypted USB device.
Per documentation viewed by the OIG, the employee said they thought the device they used to back up the files was encrypted. The watchdog was told that the worker’s supervisor “verbally advised them of the expectation” to use an encrypted device, though there was no written record of the directive.
In 2023, the staffer tried to send classified FOMC information to their personal email account. The Fed’s IT unit blocked the attempt, and International Finance leaders told the watchdog that the employee claimed the incident was “‘inadvertent.”
Later that year, the individual “potentially” copied 83 sensitive FOMC files to an unencrypted USB device; three of those files contained possible classified information, per data loss prevention alerts.
Those alerts, however, were deemed “false positives and the files were publicly available,” the OIG noted. Still, it was not reiterated to the employee or documented in writing that only encrypted USB devices should be used when sensitive information is being transmitted.
Finally, in the last 90 days of the staffer’s employment with the Fed, they set off 279 data loss prevention alerts, with 111 of those potentially containing sensitive FOMC material and another 40 possibly involving restricted central bank documents.
The employee, who had a “lengthy research” career with the Fed in which they were tasked with analyzing previously classified information, appeared to violate security protocols in several ways: printing out information, copying data to a notepad app, sending sensitive info in emails to several personal email addresses, and transferring files to an unencrypted USB device. The individual also traveled to a country around this time that the board had designated as restricted.
The OIG determined that the Fed fell short on multiple fronts in dealing with this employee, calling the board out for insufficiently reviewing the incidents and not properly escalating them.
The central bank’s information security program and enforcement controls aren’t clear enough, nor are its response protocols for incidents involving the removal of information, the watchdog said. The standards for departing employees are also inconsistent, it said.
“The 2024 incident was not fully resolved and the removed information was not fully retrieved,” the OIG concluded. “The failures in this situation were not limited to one division. The failures involved a collective lack of action across multiple divisions, and the limited follow-up activities that did occur were not commensurate with the accumulation of risks in this situation.”
The Fed did not respond to a request for comment by the time of publication, but it did agree with all nine of the inspector general’s recommendations.
