Shapiro said the case of the two DOGE team members appeared to undermine a previous assertion by SSA that DOGE’s work was intended to “detect fraud, waste and abuse” in Social Security and modernize the agency’s technology.
“SSA believed those statements to be accurate at the time they were made, and they are largely still accurate,” Shapiro wrote, adding “At this time, there is no evidence that SSA employees outside of the involved members of the DOGE Team were aware of the communications with the advocacy group. Nor were they aware of the ‘Voter Data Agreement.’”
Shapiro, a longtime DOJ veteran, said it’s not yet clear whether either of the two DOGE team members — who are not identified in her filing – actually shared data with the advocacy group, which is also unidentified. But she said emails “suggest that DOGE Team members could have been asked to assist the advocacy group by accessing SSA data to match to the voter rolls.”
The White House and SSA officials did not immediately respond to requests for comment.
Shapiro also revealed that Steve Davis, a senior adviser to Musk and DOGE’s team, was copied on a March 3, 2025 email that included a password-protected file containing private information of about 1,000 people contained in Social Security systems. It’s unclear, she said, whether Davis ever accessed the file. And Shapiro said current SSA employees have been unable to access the file to determine precisely what it contained.
Though SSA stands by its claim that DOGE “never had access to SSA systems of record,” its possible that some of the restricted data “derived from” Social Security systems was sent to Davis, she said.
Davis did not immediately respond to a request for comment.
Also among the corrections: DOJ revealed that a DOGE team member was briefly granted access to private Social Security profiles even after a court prohibited it. Shapiro said the access was never “utilized.” And in another instance, a DOGE team member had access for two months to a “call center profile” that contained private information.
“It is unknown at this time whether any [private information] was accessed,” Shapiro said.
Shapiro also revealed that despite prior assertions in court, SSA’s DOGE team members “were using links to share data through the third-party server ‘Cloudflare.’”
“Cloudflare is not approved for storing SSA data and when used in this manner is outside SSA’s security protocols,” Shapiro indicated. “SSA did not know, until its recent review, that DOGE Team members were using Cloudflare during this period. Because Cloudflare is a third-party entity, SSA has not been able to determine exactly what data were shared to Cloudflare or whether the data still exist on the server.”
