A federal cybersecurity employee’s allegations about the National Labor Relations Board have turned an obscure government IT dispute into a much larger debate about sensitive labor data, political influence, accountability, and what happens when powerful outsiders receive sweeping access to public systems. The claims remain disputed, but the questions they raise are anything but theoretical.
The NLRB Whistleblower Allegations in Plain English
On April 14, 2025, National Labor Relations Board IT employee Daniel Berulis submitted a protected whistleblower disclosure to Congress. He alleged that personnel associated with the U.S. Department of Government Efficiency, commonly called DOGE, had obtained unusually broad access to the agency’s computer environment.
The NLRB is an independent federal agency responsible for enforcing much of America’s private-sector labor law. It investigates unfair labor practice charges, conducts union elections, collects witness statements, and handles disputes involving workers, unions, and employers. Its systems therefore contain far more than meeting calendars and mildly embarrassing office lunch orders.
According to the disclosure, DOGE personnel arrived at NLRB headquarters in early March 2025 and were allegedly given “tenant owner” privileges within the agency’s Microsoft Azure environment. That level of access can allow a user to read, copy, modify, administer, or delete large portions of an organization’s cloud resources.
Berulis did not merely object to outside technicians receiving administrator accounts. His complaint described a combination of events that, in his professional judgment, resembled indicators of a cybersecurity compromise: weakened safeguards, limited audit visibility, deleted logs, suspicious outbound traffic, and attempted logins from Russia using valid credentials.
What Data Was Allegedly Removed?
The most attention-grabbing allegation involved approximately 10 gigabytes of information that appeared to leave the NLRB’s NxGen case-management system. Ten gigabytes may sound small next to a modern smartphone’s storage capacity, but database exports are not measured by how many vacation photos they can hold. Ten gigabytes of structured records can contain an enormous number of names, addresses, statements, legal documents, internal notes, and case histories.
Berulis said the unusual outbound activity occurred after DOGE-related accounts had allegedly been established. He also claimed that monitoring data needed to identify exactly what left the network was removed or made unavailable.
Why NLRB Records Can Be Highly Sensitive
Information submitted to the NLRB may include confidential affidavits, contact details for witnesses and attorneys, descriptions of organizing activity, pending legal strategies, proprietary corporate information, and allegations that have not yet been proven.
Consider an employee quietly helping organize a union at a large company. Premature disclosure of that person’s identity could expose the employee to workplace pressure or retaliation. A business involved in litigation may have submitted internal records that competitors would love to examine. Witnesses may have provided statements with the expectation that access would be restricted.
That does not mean every NLRB record is secret. Many decisions and case documents eventually become public. The concern is that nonpublic material could be copied, combined, analyzed, or distributed before legal protections and disclosure procedures have run their course.
The Cybersecurity Warning Signs Described by the Whistleblower
Extremely Broad Administrative Privileges
Modern cybersecurity programs generally follow the principle of least privilege: users should receive only the access required for a specific task and only for as long as necessary. Giving a temporary team top-level control without clearly documented boundaries would create risk even if every person involved had honorable intentions and excellent password hygiene.
Administrative access is not automatically evidence of wrongdoing. IT modernization projects often require elevated permissions. The important questions are who approved the access, what business purpose justified it, how activity was logged, and whether independent security personnel could review what happened afterward.
Changes to Logging and Device Controls
The disclosure alleged that established auditing procedures were bypassed and that certain controls preventing unauthorized mobile devices from connecting to the agency’s systems were temporarily disabled.
Security logs are the digital equivalent of a building’s visitor record and surveillance footage. They show which account entered, what it touched, and when it left. Turning off or deleting logs during sensitive work does not prove that data was stolen, but it can make a reliable investigation painfully difficult. It is rather like announcing that nothing unusual happened in the kitchen immediately after throwing away the smoke detector.
Russian Login Attempts Using Valid Credentials
Berulis also reported that an IP address located in Russia attempted to log in to NLRB systems using credentials associated with a newly created account. The attempts were reportedly blocked by geographic access controls.
An IP address alone does not identify the person behind a connection. Attackers can use compromised servers, virtual private networks, proxies, and cloud infrastructure to disguise their location. Even so, an external login attempt using a correct username and password would be treated seriously by competent incident-response teams because it suggests that credentials may have been exposed.
The crucial unresolved question is how an outside party could have obtained valid credentials so quickly, assuming the events occurred as described. Possibilities could range from misconfiguration and accidental disclosure to credential theft or deliberate sharing. A proper forensic investigation would examine authentication records, account-creation procedures, endpoint activity, network traffic, and administrative commands rather than selecting the most politically convenient theory.
Where the Political Interference Concern Enters the Story
The controversy is not simply about whether technicians followed an IT checklist. DOGE was a politically empowered initiative associated with Elon Musk and the Trump administration’s effort to restructure federal agencies, reduce staffing, and gain access to government systems.
Musk-led companies have been involved in labor disputes and NLRB proceedings. That history led lawmakers and worker advocates to question whether individuals connected to DOGE should have access to nonpublic information involving the agency’s investigations, litigants, witnesses, or corporate parties.
A potential conflict of interest is not the same thing as proof that information was misused. Still, responsible governance requires more than telling the public to trust everyone in the room. Access decisions should be documented, conflicts should be reviewed, and safeguards should be strong enough that no participant can secretly browse files unrelated to an authorized assignment.
The NLRB’s independent status also matters. Independent agencies are designed to perform specialized functions with some separation from day-to-day political direction. When an externally backed team arrives with broad technical authority, employees may reasonably wonder whether operational modernization is becoming political control by another name.
What the NLRB and White House Said
The NLRB disputed Berulis’s central claims. Agency representatives said an internal review found no breach and initially stated that the agency had no record of DOGE receiving the access described in the complaint.
The White House offered a broader response, saying DOGE personnel had been authorized to work across federal agencies as part of the administration’s efficiency program. It characterized the team as qualified and its work as focused on eliminating waste, fraud, and abuse.
Those responses did not settle the controversy. Saying that personnel were authorized to work at an agency does not answer whether specific accounts were created, which systems were accessed, why monitoring controls changed, or what caused an unusual data transfer. Conversely, seeing a large transfer does not by itself prove who initiated it or what information it contained.
More than 50 House Democrats requested answers from NLRB leadership and called for an inspector general investigation. Lawmakers asked who authorized any access, what data may have been extracted, why outbound logs were allegedly deleted, and whether controls had exposed the case-management system to unauthorized devices.
The NLRB inspector general subsequently opened an investigation into the allegations.
What a Later Government Review Foundand Did Not Find
In April 2026, the U.S. Government Accountability Office released a review of DOGE-related access at the NLRB. The GAO found no evidence that two formally detailed DOGE team members used NLRB system accounts between April 16 and July 25, 2025.
That finding is important, but its scope is equally important. Berulis’s complaint focused primarily on alleged activity in March 2025, before the formal detail agreements examined by the GAO. The GAO explicitly stated that it did not review access before April 16 because the NLRB inspector general was investigating that earlier period.
In other words, the GAO report did not confirm the alleged March breach, but it did not disprove it either. It answered a narrower question: whether the two formally assigned DOGE employees used specified accounts during the later agreement period. The answer was no.
This distinction matters because political debates have a habit of treating partial findings like all-you-can-eat buffets. Supporters may cite the report as complete vindication, while critics may ignore it entirely. The responsible conclusion is less dramatic: the later accounts reviewed by the GAO showed no sign-ins, while the earlier alleged activity remained outside the review’s scope.
Alleged Retaliation and the Personal Cost of Speaking Out
Berulis said that while he and colleagues were preparing to request assistance from the Cybersecurity and Infrastructure Security Agency, the effort was disrupted by higher-level officials. He also reported receiving a threatening message containing personal information and overhead photographs of him walking his dog.
In later legal filings and media interviews, Berulis described additional threats and an incident in which his vehicle’s brake lines had been cut. A police report documented the damaged vehicle, but investigators publicly identified no suspect, and no evidence has established that Musk, DOGE personnel, or NLRB officials were responsible for the physical incident.
In 2026, Berulis filed a defamation lawsuit against Musk, arguing that a social-media post suggesting he had made a deliberately false whistleblower claim exposed him to further hostility. The allegations in that lawsuit remain to be resolved through the legal process.
Whatever the eventual findings about the underlying data incident, threats against an employee for reporting a suspected security problem are unacceptable. Federal employees are legally protected when they disclose conduct they reasonably believe involves violations of law, gross mismanagement, abuse of authority, or substantial public-safety dangers.
Why the NLRB Data Breach Allegations Matter Beyond One Agency
The federal government holds vast collections of personal, financial, medical, employment, immigration, tax, and law-enforcement information. Efficiency programs may legitimately seek to modernize outdated systems, remove duplication, and improve services. However, combining powerful data access with unclear leadership, weak documentation, or political conflicts can create risks larger than the inefficiencies being targeted.
Access Must Be Tied to a Defined Mission
Every privileged account should have an identified owner, a documented purpose, an approving authority, an expiration date, and auditable activity. “We are here to find waste” is a slogan, not an access-control policy.
Logs Must Be Protected From the People Being Logged
Organizations should store security records in systems that privileged users cannot quietly edit or erase. Independent log retention allows investigators to reconstruct events even when an administrator account has been compromised.
Conflicts of Interest Require Technical Safeguards
Ethics forms and promises are useful, but segmented databases, approval workflows, monitoring alerts, and access reviews are more dependable. Good governance assumes that even trusted people can make mistakes, become curious, or face competing loyalties.
Incident Reports Must Trigger Independent Review
When an employee identifies credible indicators of compromise, the investigation should not depend exclusively on the managers whose decisions are being questioned. Independent inspectors general, cybersecurity agencies, and congressional oversight exist because asking an institution to investigate itself can produce the bureaucratic equivalent of a student grading his own exam.
Experiences and Practical Lessons From Similar Cybersecurity Disputes
People who have worked through suspected data breaches often say the first warning is surprisingly ordinary. There may be no flashing red screen, masked hacker, or dramatic message demanding cryptocurrency. Instead, an analyst notices a login at an odd hour, a sudden traffic spike, a disabled alert, or an administrator account behaving differently from its normal pattern.
The earliest stage is usually filled with uncertainty. A suspicious transfer might be a backup job. An unfamiliar account might belong to a contractor. A missing log might result from a configuration mistake. Experienced responders do not begin by declaring a conspiracy. They begin by preserving evidence and testing possible explanations.
That process can become difficult when the suspected activity involves senior officials or politically connected personnel. A junior analyst may be told that the access was approved and that further questions are unnecessary. In healthy organizations, approval does not end the conversation. It begins a more precise one: approved by whom, for what purpose, under which controls, and with what record of activity?
Another recurring lesson is that documentation protects everyone. Screenshots, timestamps, access requests, ticket histories, configuration changes, and contemporaneous notes allow investigators to separate facts from memory. They can support a whistleblower’s account, but they can also clear people who were wrongly suspected. Evidence is refreshingly indifferent to political affiliation.
Employees considering a protected disclosure often face a painful calculation. Reporting internally may resolve the issue quietly, but it may also alert the people responsible for the disputed decision. Reporting externally can bring independent scrutiny, yet it may expose the employee to career damage, public attacks, legal expenses, or personal stress.
The NLRB controversy illustrates why organizations should provide multiple reporting paths. Employees need access to an inspector general, an independent ethics office, legal counsel, cybersecurity investigators, and protected congressional channels. A reporting system controlled by one supervisor is not much of a system; it is a suggestion box with a shredder underneath.
Leaders also need to avoid treating every warning as insubordination. Cybersecurity professionals are hired to be professionally skeptical. An analyst who asks why logging was disabled is not necessarily resisting change. The analyst may be doing exactly what taxpayers hired that person to do.
After a disputed incident becomes public, rebuilding trust requires more than competing press releases. Agencies should explain the scope of each investigation, the dates examined, the systems reviewed, the evidence preserved, and any limitations. A review covering April cannot automatically answer an allegation about March. Clear timelines prevent narrow findings from being stretched into sweeping political claims.
The final lesson is that cybersecurity and institutional legitimacy are now inseparable. Citizens may never understand every detail of cloud permissions or identity-management logs, but they understand secrecy, conflicts, and inconsistent explanations. When agencies cannot demonstrate who accessed sensitive data, public trust becomes another asset leaving the building.
A mature response therefore focuses less on winning the daily argument and more on creating verifiable records. Preserve the logs. Restrict the accounts. Invite independent review. Protect employees who report concerns in good faith. Then publish findings that clearly separate what was proven, what was ruled out, and what remains unknown.
Conclusion
The whistleblower allegations at the National Labor Relations Board present a serious but still partly unresolved story. Daniel Berulis described broad administrative access, weakened monitoring, an unexplained transfer of approximately 10 gigabytes, attempted Russian logins using valid credentials, and interference with an incident-reporting effort. The NLRB denied that a breach occurred, while congressional investigators and the agency’s inspector general sought additional answers.
A later GAO review found no evidence that formally detailed DOGE employees accessed NLRB systems during a period beginning April 16, 2025. Because that review did not cover the alleged March activity, it should neither be ignored nor mistaken for a complete resolution.
The larger issue is straightforward: extraordinary access to government data requires extraordinary accountability. Whether the ultimate explanation involves misconduct, poor configuration, confused authorization, or several failures occurring at once, the public deserves a technically credible investigation rather than a partisan guessing contest.
