GSA exposed sensitive information to all agency users on Google Drive, OIG finds

The General Services Administration is “not effectively” protecting controlled unclassified information in its Google Drive, exposing it to all GSA users and contractors, its Office of the Inspector General found in a report released Tuesday.

In a limited search of the drive, the OIG found that 116 files included physical security information, personally identifiable information, general proprietary business information or other CUI and were shared agency-wide, the redacted report said. 

This included Social Security numbers, dates of birth, phone numbers, addresses and vendor proposals with pricing information, as well as site and floor plans, with details on building vulnerabilities and security areas, it said.

“These exposures also leave GSA vulnerable to significant reputational risk and potential litigation,” the report said of PII. 

More than half of the files identified contained physical security information, and five of the files contained PII. 

The OIG put some blame on ineffective management of the agency’s third-party data loss prevention tool, which it did not explicitly name, though GSA Chief Information Officer David Shive mentioned a tool called Cloudlock.

“GSA did not detect that the CUI was exposed in its Google Drive because of deficiencies in its oversight,” the report said. “Specifically, GSA does not effectively manage its data loss prevention tool, which is a third-party software application used to prevent and detect CUI exposures.”

This tool, which GSA has spent $7.8 million on as of September, the report said, did not detect exposed documents with current search terms and can only handle files up to 15 megabytes. About a third of the files contained the phrase “for official use only” or some variant of it, which was not caught by the tool.

GSA does not have standard naming conventions or an approval process for sharing sensitive information, the report said. GSA could not show it fully completed any annual review of the tool’s search terms from 2015 through 2024, with records for five of those years missing, and the individuals who handled the tool’s reviews “are no longer with the Agency.”

GSA management estimates that agency users and contractors have 2.5 million documents stored in GSA’s Google Drive, the OIG said of its review from March to December 2025.

The OIG has investigated CUI exposure on GSA’s Google Drive in the past — most recently in April 2025, when it found vendor financial data and U.S. courthouse blueprints were exposed to all GSA users and contractors.

The OIG issued seven recommendations in the new report, including identifying other documents not found in this audit and improving management of the data loss prevention tool, with which Shive concurred.

“Please note that GSA IT’s review determined that the identified documents were not exposed externally, and that, based on file access reviews and user interviews, there was no indication of malicious intent,” Shive wrote. 

Shive also said GSA IT took “significant corrective actions to strengthen the protection of sensitive information across GSA’s Google Workspace” while the audit was underway, including updating policies and procedures.