A major US federal agency has repeatedly left sensitive information in its Google Drive accessible to employees and contractors who had no legitimate business need to see it, and auditors aren’t happy. The General Services Administration (GSA), which handles contracting, procurement, property management, and other elements of basic operations for federal agencies, has faced repeated findings of inadequate protection for controlled unclassified information (CUI) since at least 2014, according to a report from the agency’s Office of Inspector General.

Again. Controlled unclassified information, in the US federal government's parlance, is information that isn't classified but requires protection or restrictions on its distribution under applicable laws, regulations, or government-wide policies. Access is generally limited to individuals with a legitimate government need to know. According to the OIG report, that can include things like physical security info for government buildings, personally identifiable information (PII) of government employees, and proprietary business information, all of which the GSA has left exposed.

According to the report published this week, employees and contractors have approximately 2.5 million documents stored in GSA's Google Drive. “During a limited search of GSA’s Google Drive, we found 116 files containing CUI that were improperly shared with all GSA users,” the report notes. That’s a limited search, mind you, and the OIG has plenty of reason to believe there’s more than just that sitting open for anyone with access to the GSA’s Google Drive instance to sneak a look at.

The OIG said that GSA is failing to properly manage the third-party tool it has in place to prevent data loss and detect CUI exposures, with annual reviews of search terms incomplete or undocumented, many relevant search terms not implemented, and a failure to enable an available optical character recognition feature that could help detect CUI in scanned documents.

Additionally, the GSA was apparently “unaware of the tool’s file size limitation of 15 megabytes,” meaning that even if the GSA was properly using that tool, some large files would still be skipped. “We also found that GSA lacks: (1) an approval process for properly sharing sensitive information and (2) a standard naming convention that could more effectively prevent exposures of CUI in GSA’s Google Drive,” the OIG added.

As for what was exposed … it’s not great. According to the audit, site plans for buildings in Washington, DC were part of the improperly access-controlled files, with data that includes entrances and screening techniques, as well as the location of sensitive areas, like gun lockers. A progressive collapse analysis that "describes the building’s collapse vulnerabilities, defense vulnerabilities, and critical failure locations” was also exposed. PII of government individuals was also exposed, including social security numbers, addresses, dates of birth, and contact information.

Proprietary business information was also exposed, “including proprietary research and vendor proposals with technical and pricing information.”This might not have been publicly accessible, but it’s still a shocking lapse of data control, especially given that contractors with access to the GSA’s Google Drive could potentially view proprietary information belonging to competing vendors, giving them an unfair advantage if they used it. To make matters worse, this isn’t the first time the GSA has been dinged by its own inspector general for such lousy data protection practices.

According to the report, it was 2014 when the OIG first spotted such bad habits. “In August 2014, we first reported that GSA did not protect sensitive information on child care centers, courthouses, water sources, building automation systems, and security and fire alarm systems in its Google cloud computing environment,” the OIG noted.

“We issued additional reports citing concerns regarding GSA’s ability to protect sensitive information in its Google environment between 2015 and 2017.”Auditors flagged another set of improperly shared Google Drive files in April 2025. While the GSA’s chief information officer agreed with the auditors’ seven recommendations to fix the problems, the report doesn't establish whether the corrective work has been completed. The GSA has been in touch to argue it never exposed anything, thank you very much.

“While the audit was underway, GSA IT confirmed their protective measures prevented the identified documents from external exposure," a GSA spokesperson told The. "Immediately following, significant actions were taken to strengthen the protection of CUI across the agency’s Google Workspace. GSA IT is working to fully address the Inspector General’s recommendations.”® Updated at 1933 UTC with comment from GSA.