GSA audit finds sensitive files shared too widely in Google Drive

A US government watchdog found 116 files containing controlled unclassified information shared with all users of the General Services Administration’s Google Drive. The audit says the agency’s safeguards had gaps, while GSA says measures prevented the files from being exposed externally and that it is working on fixes.

Watch Desk analysis

What happened

The Office of Inspector General found the files during a limited search of a Drive holding about 2.5 million documents. The files included personal information, vendor material and building security details, according to The Register’s account of the audit. The watchdog also identified weaknesses in the agency’s data-loss prevention tool, including incomplete reviews of search terms, an optical character recognition feature that was not enabled, and a 15-megabyte file-size limit GSA was unaware of.

The report says similar protection problems have been flagged since 2014, with another set of improperly shared files identified in April 2025. The Inspector General made seven recommendations; the supplied account does not establish whether the corrective work is complete. GSA told The Register that protective measures prevented external exposure and that it is working to address the recommendations. The Register’s report describes the audit findings and the agency’s response.

Why it matters

This is a concrete cloud-security failure in access control and detection, not evidence that the files were publicly available on the internet. The distinction matters: information shared too broadly inside an organisation can still reach people without a legitimate need to see it, while GSA disputes that it was exposed externally.

The audit also points to familiar ways safeguards can miss sensitive material: incomplete search rules, unscanned document images and file-size limits. A tool can be installed and still leave sizeable gaps if its settings and coverage are not properly managed.

Our read

The limited search found 116 files, but the audit’s own scope means that number should not be mistaken for a full count. GSA’s response is important, too: the reported access-control failures are serious, but the account does not establish external disclosure. The useful next step is to see whether the agency completes the watchdog’s recommendations and demonstrates that its controls now cover the files they are meant to protect. Security tools are only as reassuring as the settings someone remembered to switch on.

What to watch

• Whether GSA completes the seven recommendations and reports measurable changes.
• Whether the Inspector General establishes the extent of the files affected beyond the limited search.
• What evidence GSA provides for its statement that external exposure was prevented.

Discussion spark: If files were accessible to staff and contractors without a business need but not exposed externally, should that count as a serious data breach, or is the distinction decisive?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.