The scope was internal but broad
A General Services Administration inspector-general audit found 116 documents containing controlled unclassified information exposed in Google Drive to all GSA users. Controlled unclassified information is not classified national-security material, but it still requires handling protections.
The exposure was agency-wide access, not a finding that the files were published on the open internet. That qualification is central to accurately describing the incident.
| Measure | Count |
|---|---|
| Identified CUI documents | 116 |
| Open recommendations | 7 |
| Questioned costs | $0 |
| Funds put to better use | $0 |
The seven fixes cover both immediate and systemic risks
Recommendations call for restricting the 116 identified documents, finding additional exposed files, notifying affected people where appropriate, strengthening approval and naming practices, improving training, expanding data-loss-prevention search terms and addressing optical-character-recognition and large-file limits.
The list shows why correcting 116 sharing settings is not the whole job: detection tools and governance can determine whether the same condition returns.
Exposure does not prove download or misuse
The audit establishes that access permissions were too broad. It does not publicly identify an external breach, prove that every document was opened by an unauthorized employee or assign a dollar loss.
The absence of questioned costs is not proof of harmlessness. It means the audit did not claim a recoverable expenditure; privacy and operational risk can exist without a booked financial loss.
Method and limits
What’s the Scoop With Broach separated the document count, recommendation count and financial fields in the official record, then classified the corrective actions by immediate restriction, discovery and preventive control. The technical audit belongs to GSA OIG.
The public report does not reveal every document’s contents or a complete access log. It cannot support a claim that information reached the public or that a named person misused it.