A limited search found concrete exposure
The General Services Administration inspector general reported that 116 files containing controlled unclassified information were improperly shared with all GSA users. Examples included building blueprints and access points, personally identifiable information and proprietary business material.
GSA’s Google Drive contains about 2.5 million documents. The 116 is a confirmed count from a limited search, not a prevalence estimate. Dividing it by all Drive documents would produce a misleading rate because the audit did not randomly test the full population and its tools missed known categories.
| Measure | Finding |
|---|---|
| Drive documents | About 2.5 million |
| Improperly shared CUI files found | 116 |
| Recommendations | 7 |
| Full-population prevalence | Not measured |
The detector itself had blind spots
The report says annual reviews of data-loss-prevention search terms were incomplete, optical character recognition had not been implemented and a 15-megabyte file-size limitation was not fully understood. Current terms missed some documents, and terms in agency guidance were absent from the detection process.
Those weaknesses mean the central accountability finding is both the 116 exposed files and the inability to say how many more existed. A control cannot be evaluated solely by the alerts it produces when its search coverage is undocumented.
Management agreed to seven recommendations
The inspector general made seven recommendations addressing access, detection, documentation and monitoring. GSA’s chief information officer agreed, according to the October 27 report.
Agreement is not completion. Future closure should show that agency-wide sharing was corrected, OCR and large-file coverage were resolved and search-term decisions can be reconstructed. The report does not say the exposed information was publicly accessible outside GSA.
Method and limits
What’s the Scoop With Broach treated 116 as a minimum confirmed count and rejected a percentage calculation that would imply a representative sample. Findings are those of the GSA inspector general.
The public report does not identify each file, every person with access or evidence of malicious use. Controlled unclassified information is sensitive but is not the same classification as national-security classified material.