GSA left sensitive information in its Google Drive exposed, watchdog finds

The General Services Administration did not effectively protect physical security, personally identifiable data and general proprietary business information stored within its Google Drive, according to an audit released Tuesday by the agency’s Office of Inspector General.

In a limited search of GSA’s Google Drive, the OIG found 116 files containing controlled unclassified information, or CUI, that were improperly shared with employees and contractors who did not have a legitimate business reason to know those details. The exposed data included Social Security numbers, phone numbers, proprietary research, vendor proposals and site plans for a Washington, D.C. building.

GSA IT’s review determined that the identified documents were “not exposed externally” and found “no indication of malicious intent,” according to a response letter from David Shive, GSA’s chief information officer.

The watchdog attributed the improper exposure of sensitive information to “deficiencies” in GSA’s oversight. 

The OIG said the agency did not effectively manage a third-party data loss prevention tool, used to prevent and detect CUI exposures. 

That tool searches documents shared in GSA’s Google Drive for CUI-related keywords or phrases. If the tool detects CUI, it performs a “pre-designed response,” which could include restricting access to the document, flagging the document to GSA’s Security Operations and Engineering Division and sending an automated email to the document owner, according to the OIG audit.

But GSA did not fully complete annual reviews of the tool’s search terms to ensure it detected CUI and did not incorporate “many relevant terms” from agency guidance into tool searches, the watchdog concluded. Tool searches also failed to detect documents that included search terms.

GSA also did not implement a tool feature known as optical character recognition that could have prevented CUI exposures, did not document program decisions affecting CUI protection in the Google Drive and was not aware of the tool’s file size limit of 15 megabytes, OIG wrote.

In addition to mismanagement of the tool, OIG found GSA lacked an approval process for properly sharing sensitive information and a standard naming convention that could help prevent CUI exposures in its Google Drive.

The office gave GSA seven recommendations to prevent future CUI exposures: 

• Restrict access to all 116 CUI documents exposed in GSA’s Google Drive to only GSA users with a lawful government purpose for accessing them.
• Identify and restrict access to other CUI documents not found through OIG’s audit.
• Notify individuals affected by the exposed information in accordance with GSA policy.
• Implement additional controls, such as an approval process for sharing CUI documents, a standard naming convention for CUI documents and new agency training materials.
• Improve management of the data loss prevention tool through annual search term reviews and use of CUI guidance terms.
• Assess and implement new data loss prevention tool features, such as optical character recognition and methods to identify CUI documents larger than 15 megabytes.
• Develop a process to document and maintain operational decisions for the data loss prevention tool.

Shive said GSA IT agrees with all of the recommendations and is “working on a plan to address them.”

He added that GSA IT took “significant corrective action to strengthen the protection of sensitive information across GSA’s Google Workspace” while OIG was conducting its audit. 

Those actions included updating internal procedures, restricting access to documents shared domain-wide “as appropriate,” and evaluating additional controls and tools to flag CUI exposure. The agency also adopted the optical character recognition feature that OIG recommended be implemented, according to Shive’s letter.

The report released Tuesday is not the first time OIG has found that GSA did not adequately protect sensitive information stored on Google technology.

In August 2014, the office reported that GSA did not protect information about child care centers, courthouses, water sources, building automation systems, security systems and fire alarm systems in its Google cloud computing environment. OIG issued additional reports between 2015 and 2017 that raised concerns about GSA’s ability to protect sensitive information within the Google environment.

In April 2025, the office found GSA’s Google Drive contained documents with sensitive information that users did not need to know, such as CUI, safety environmental management surveys and vendor financial information.