GOVERNMENT ACCOUNTABILITY

GSA inspector general found 116 Google Drive files accessible to all agency users, outlets report

Reporting says auditors flagged broadly shared Google Drive items — precise filenames, dates and whether the files contained PII or classified material were not publicly detailed in the initial coverage.

By Freedom News Staff • Freedom News Media • October 30, 2026

Exterior view of the main entrance to the General Services Administration (GSA) Headquarters Building at 1800 F Street NW, Washington, D.C. — Photo: Own work · CC BY 4.0

What reporters say the inspector general found

Multiple technology and government-focused outlets reported this week that the General Services Administration's Office of Inspector General (OIG) identified 116 files in the agency's Google Drive that were accessible to all GSA users. Outlets covering the finding include ExecutiveGov, FedScoop, Nextgov/FCW, The Register, CDO Magazine and other tech news services.

The coverage describes the files as "sensitive" and, in at least one outlet's account, as Controlled Unclassified Information (CUI). Reporters say the OIG finding shows those files were shared with a wide internal audience instead of being restricted to the small set of users who needed them.

None of the outlet summaries reviewed for this article included a full public copy of the inspector general memo or report, and the initial coverage did not supply sample filenames, publication dates for the exposed files, or a definitive statement that the files contained personally identifiable information (PII) or classified material.

What is known — and what remains unclear

The consistent, independently reported elements are: the OIG identified 116 files in Google Drive that were accessible to the entire agency, and the files were described as sensitive by multiple outlets. CDO Magazine explicitly identified the items as CUI in its summary of the OIG finding.

Important specifics were not available in the reporting reviewed for this article. The public summaries do not list sample filenames or document types, do not provide the dates when the files were exposed, and do not say whether any of the exposed documents included PII or material requiring a classified-handling designation. The full OIG text would be needed to confirm those details.

Because the primary inspector general document was not included in the reports reviewed, this story relies on multiple independent outlets' reporting about the OIG finding rather than direct inspection of the OIG memo itself.

How drive-sharing errors typically happen (background)

The coverage uniformly frames the issue as an access-control misconfiguration in Google Drive that left documents available to an overly broad group — in this case, all agency users. That phrasing describes a common class of misconfiguration in cloud file systems: files or folders are shared with organization-wide viewers rather than specific groups or individual accounts.

For readers unfamiliar with Google Workspace settings, an administrator or user can set a file to be visible to specific people, to anyone with a link, or to everyone within the organization. Setting a file to be visible to all users at an agency can be intentional for broadly useful materials, but when done for sensitive documents it creates a risk that employees or contractors without a need-to-know can access them.

The OIG reporting summarized by news outlets attributes the exposure to improperly applied or missed access restrictions, but the reviewed coverage does not describe the exact technical mechanism the inspector general identified — for example, whether the exposure resulted from folder inheritance, group membership errors, default sharing policies, or administrative oversight.

Why this matters for privacy and operations

Files labeled as CUI are not classified, but they are controlled because they can include sensitive information whose unrestricted disclosure could harm privacy, proprietary interests, or agency operations. Broad internal access to CUI undermines the controls the CUI framework is designed to provide.

Even when files do not contain classified information, improper internal exposure can increase the chance of accidental leaks, create compliance issues with federal handling requirements, and complicate incident response if records include PII or contractor-sensitive data. The reviewed reporting did not identify any confirmed downstream disclosure or operational harm tied to the 116 files; it reports only the OIG's finding of wide accessibility.

GSA response, oversight and next steps

The initial coverage did not include a substantive public response from GSA leadership or the agency's information security office in the summaries reviewed for this article. A GSA public statement, a technical remediation timeline, or the OIG memo itself would clarify whether the files were promptly secured, what root causes the OIG identified, and whether additional controls or training are planned.

From an oversight perspective, the typical next steps would include GSA implementing fixes to sharing policies, auditing other cloud repositories for similar exposures, and — if the OIG recommended remedial actions — publishing an agency response and a corrective action plan. Those steps are standard in cloud-access findings, but the specific actions GSA will take in this case remain unreported in the sources reviewed here.

Freedom News will seek the underlying OIG memo and official comment from GSA's inspector general office and the agency's IT security leadership to verify the items' classification, the exact access-control failures the OIG documented, and any remediation the agency has completed.

What readers should watch for

Look for a public OIG report or memo that includes sample filenames, dates of exposure, and the OIG's technical findings. That document would allow independent verification of whether files included PII, the degree of sensitivity, and whether the exposure was a one-time event or part of a repeated pattern.

Watch for an agency response describing what GSA has done to secure the files, whether staff training or policy changes are being implemented, and whether other federal agencies using the same cloud tooling have reported similar inspector general findings.

Finally, because many federal agencies now rely on cloud-native collaboration tools, inspectors general and agency security teams will likely keep this topic on their remediation lists; additional OIG or agency reports may follow and will be important to interpret the broader risk picture for government cloud data.