US Audit Finds 116 Sensitive Federal Files Improperly Shared in GSA Google Drive

An October 27 audit of the US General Services Administration (GSA) found that 116 files containing controlled unclassified information had been improperly shared across the agency’s Google Drive environment, making them accessible to employees and contractors without a legitimate need to see them. The finding raises questions about the federal government’s handling of sensitive records, but it is not a finding that outsiders accessed the files or that a malicious breach occurred.

The GSA Office of Inspector General (OIG), in report A250043ITF27002, said its limited search found protected physical-security, personal and proprietary business information exposed through permissions that were too broad. The agency told auditors that roughly 2.5 million documents were stored in its Google Drive. The 116 identified files are therefore an audit finding from a limited search, not a count of every potentially affected record in the wider collection.

The inspector general traced the problem to deficiencies in oversight of the agency’s data-loss-prevention software. According to the audit, GSA had not completed some annual reviews of the tool’s search terms, searches missed documents containing relevant terms, optical-character-recognition capabilities had not been implemented, and officials were unaware of a 15-megabyte file-size limitation. Auditors also found no adequate approval process for broad sharing of sensitive files and no standard naming convention to help identify them.

The distinction between internal exposure and an external data breach matters. Independent reporting by Nextgov/FCW cites GSA Chief Information Officer David Shive’s response that an internal review found the identified documents were not exposed externally and showed no indication of malicious intent. That response does not negate the inspector general’s finding that people inside the agency or its contractor workforce could access information without a business need.

The watchdog issued seven recommendations, including restricting access to the 116 identified files, searching for other exposed records, notifying affected individuals where required by agency policy, strengthening sharing controls and improving the detection tool. The inspector general’s public report says the GSA chief information officer agreed with the recommendations; Shive told Nextgov/FCW that GSA was working on a plan and had taken corrective measures during the audit.

The finding also has a longer institutional history. The OIG says it first reported failures to protect sensitive information in GSA’s Google cloud environment in 2014, with further concerns raised between 2015 and 2017 and new examples identified in April 2025. The latest audit therefore points to recurring weaknesses in access governance rather than a newly confirmed external intrusion. Whether the seven recommendations are implemented, and whether a wider search finds additional improperly shared records, will determine the scope of corrective action. The public report does not establish that every one of the 2.5 million stored files was at risk, nor does it attribute criminal intent to any individual.