Two kinds of evidence should not be collapsed
The military services reported 49 personnel-information breaches during fiscal years 2021–2025, affecting more than 1,000 service members. But those 49 incidents are not a count of 49 improperly approved public-record requests. A footnote in the federal audit released October 16 identifies 15 of the Navy’s 17 incidents as unauthorized disclosures through unsecured email, rather than breaches caused by processing a records request.
What’s the Scoop With Broach compared the incident table, covert-request test, staffing chronology and Pentagon response in GAO-27-107784. The distinction changes the accountability question: what protection is needed at each release pathway, and do announced staffing changes demonstrate that those protections now work? The record documents an authentic control failure and delays, but it does not support one universal failure rate.
The incident table includes potential or confirmed breaches reported by the services. The Air Force, including Space Force data, reported 24; the Navy 17; the Army eight; and the Marine Corps none. Reporting no incident is not proof that none occurred, because officials described self-reporting. Nor can the incident count simply be divided by record-request totals when some incidents arose outside that process.
The covert test found one improper release and a separate response problem
GAO submitted 26 nongeneralizable third-party requests, using intentionally flawed submissions to test safeguards as well as two valid FOIA requests. Three requests were approved: the Marine Corps appropriately released records for the two valid FOIA requests, while the Army approved a flawed submission and disclosed personally identifiable information that should have been redacted. Three other requests were denied because of the deliberate flaws.
The remaining 20 did not produce a release decision during the testing described in that portion of the report. That does not mean all 20 went unanswered. GAO’s separate timeliness analysis says 18 of the 26 received an appropriate response within the applicable or generally accepted period; eight received no decision, acknowledgment or request for additional information. An acknowledgment and a completed production are different milestones.
Eight divided by 26 is 30.8% of this selected test without that timely initial response. It is not a national nonresponse rate. Likewise, one improper release does not establish the prevalence of privacy violations across hundreds of thousands of requests. The test was designed to expose weaknesses, not statistically estimate them.
The Navy’s one-worker description needs its later update
The Navy’s FOIA operation had one federal civilian processor during GAO’s review after another official retired. The detailed chronology reports average processing time rising from 1.64 days in fiscal 2018 to 55.5 in fiscal 2024, then 77.4 as of July 2025. Those are differently dated reported measures, not an October 2026 live service-time dashboard.
The same audit records that Navy Personnel Command hired an assistant in late December 2025. By April 2026, officials described a backlog-reduction plan using two civilians, reserve officers and other internal assistance. Reporting that the Navy still has only one processor would omit material counterevidence in the source itself. The audit does not independently establish that the later plan eliminated delays.
The Army also reported a March 2026 reorganization centralizing receipt and tracking, standardizing checks and automating routing without hiring additional FOIA staff. Officials said timeliness and accuracy improved. GAO notes that this process was not in place during its covert testing. That timing prevents the failed Army test from proving the new workflow failed—and prevents the agency’s assertion from serving as an independently verified repair.
What the Pentagon disputed, and what remains open
DOD agreed with the five recommendations while disputing aspects of the report’s data presentation and governance description. It said more than 90% of incidents were low-risk administrative errors causing no individual harm. GAO included that position but did not independently assess each incident’s risk. It also explained that central privacy governance exists, while release decisions occur in service offices.
The agency disputed calling request data unreliable. GAO clarified that reliability was undetermined, not that the figures were proven false; service-center data offered the needed detail absent from department-wide annual FOIA reports. These limitations matter when interpreting backlog or timing comparisons. We do not turn the tables into a precise department-wide rate.
The five recommendations remained open on GAO’s official page October 18. They call for service-level workforce planning and assessment of health-record processing systems. Our original contribution is separating incident pathways and response milestones, then testing the alarming staffing description against the later corrective chronology and actual agency objections. This is public-document reporting, not firsthand testing by Billy Roach, a new interview or a finding that every unauthorized disclosure caused identity theft.
Sources and further reading
GAO current recommendation status checked October 18, 2026 ↗