[twalkz]

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts.

Feels like a pretty good Occam’s razor case… but is there any legitimate reason why one would request this?

[rtkwe]

Even worse when you know more of the whistleblower's story which is that ~15 minutes after one of DOGE's accounts were made there was an attempted login with the correct password from Russia. Not many explanations for that that look good for DOGE...

[ourmandave]

That's straight up traitorous.

DOGE needs to be shutdown and everyone of them held as a flight risk while the whole thing is investigated.

[stephenitis]

Citation?

[pan69]

> all-powerful “tenant admin” accounts that were to be exempted from network logging activity

Is this normal to build this sort of functionality into a software system? Especially software systems that heavily rely on auditability?

[michaelt]

Sometimes, depending on the situation.

My company retains all e-mails for at least 5 years, for audit purposes. But if some troublemaker were to e-mail child porn to an employee, we'd need to remove that from the audit records, because the laws against possessing child porn don't have an exception for corporate audit records.

So there's essentially always some account with the power to erase things from the audit records.

[katbyte]

No. Never. While it’s expected to have a “root” account exempting from logging serves no honest purpose.

[sanderjd]

Of course not. It's the exact opposite and every single person here knows this.

[sellmesoap]

From a an old hackers perspective disabling shell history can have positive security implications. But in today's 'cattle not pets' systems mentality I'd expect all actions to have a log and not having that seems fishy to me. Keeping logging infra secure has a dubious, the log4j fiasco comes to mind. I'm not a fan of regulation for most things, but I think we need a higher cost for data leaking since security is an afterthought for many orgs. My personal leaning is to be very choosy about who I'll do business/share data with.

[typs]

> “We have built in roles that auditors can use and have used extensively in the past but would not give the ability to make changes or access subsystems without approval,” he continued. “The suggestion that they use these accounts was not open to discussion.”

From the previous post, they had auditor roles built in that they purposely chose to go around

[XorNot]

It's the same as domain admin in active directory.

You always need it to setup the system initially.

It's like root on Linux: it's an implementation detail that it must be possible.

[vkou]

There isn't one.

Anything musk's dogs claim to find cannot be taken at face value because of this. Because there is no audit, and no evidence that they can offer that they didn't doctor their findings.

The next time they claim that a 170-year old person is receiving SS checks, they have no way to prove that they didn't subtract a century from that person's birthdate in some table.

[FredPret]

Ah, this is something I haven't thought of before. This might not actually be spying, but instead just an attempt to plant fake results.

[Cthulhu_]

Sure, to hide your tracks because you know what you intend to do isn't right.

[plandis]

I can’t think of any. Even if you wanted to give someone broad permissions to access and modify data, you wouldn't turn off the audit logs.

[patrickmay]

There is no justification for ever creating an account like that. The only purpose is nefarious.

[largbae]

I am sure they demanded maximum access, but the logging activity phrasing sounds a little bit like spin...

I think if I wanted to describe an account with access to perform "sudo -s" as negatively as possible, I would say "an all-powerful admin account that is exempt from logging activity that would otherwise keep a detailed record of all actions taken by those accounts."

[api]

To allow dodgy offshore actors to snarf huge amounts of data on US citizens to prepare a huge propaganda assault for the next election?

[tootie]

Interview with whistleblower detailing the attack and the threats directed against him:

https://www.pbs.org/newshour/show/nlrb-whistleblower-claims-...

[cmurf]

this guy's lawyer says: This is a difficult topic for Dan to discuss, but prior to our filing the whistle-blower disclosure this week, last week, somebody went to Dan's home and taped a threatening note, a menacing note on his door with personal information.

...

While he was at work, and it also contained photographs of him walking his dog taken by a drone.

This is mafia shit.

[Suppafly]

I'm only really familiar with the 'tenant admin' concept from microsoft administration, it's commonly used otherwise?

[spencerflem]

Obviously no

[jimt1234]

The Deep State! The government is filled with spies determined to "leak" the great work DOGE is doing is the press - so, of course, it needs "God mode" access. Totally legit.

That's the best I could do. LOL

[1oooqooq]

very clear admission of guilt.

[sanderjd]

Thing is: Everything they're doing is against the rules. Except they aren't "rules", they are laws.

[int0x29]

These aren't rules made by bureaucrats. They are laws written by Congress, a coequal branch of government, in response to the Nixon administration's abuse of executive power

[aSanchezStern]

I don't think that "arguing that something is against the rules" is in the CIA sabotage manual, because it's not generally considered sabotage. Maybe if you argue things are against the rules that you know aren't, to slow things down?

[only-one1701]

What’s that dril quote? There’s no difference between good things and bad things? That’s what this last sentence sounds like.

[jayd16]

This doesn't really make sense. If its in the logs, then they already did it. They weren't slowed at all.

This doesn't really apply to the situation in the slightest.

[watwut]

If your logs show your actions are against the rules, pointing that out is not "sabotage". It is being good guy employee, reporting your against the rules actions.

This one is very very clear and unambiguous. There is no symmetry in your example. The Civil servant is actually in the right and doge bro in the wrong.

[acdha]

This doesn’t make sense unless they’re doing something illegal. They have backing from the top to audit the system. They don’t have to answer to any of the people who might complain, so the only reason they need to do this is if they’re doing something which violates federal laws where the penalties are worse then getting an angry email from someone in the security group who your boss will yell at for you.

The other big problem with this theory is that there’s no evidence of sabotage. During the first Trump administration, federal employees followed their leadership just like they had for Obama, Bush, etc. and every sign shows that would have happened again, except for the refusal to take on personal liability for breaking federal laws.

[timewizard]

> Now imagine you're a DOGE bro

What does any of this data have to do with making the department more efficient? I can't imagine doing _any_ of this if that was my actual goal.

> and so do the DOGE bros.

When I believe my actions are "fully justified" then that is _precisely_ when I want logging enabled. So no one on Earth could dispute that.

[Aeolun]

This is… the most reasonable explanation I’ve heard so far for everything that is happening.

God knows there must be enough normally unused rules in the federal government.

[mfer]

Setting aside legitimate (thats a matter of judgement)...

Some previous attempts for DOGE to get data has resulted in data being deleted before they can look and requests for judges to block access to data.

DOGE may be trying to be covert in order to stop these two activities from happening before they can get and review the data.

[throwworhtthrow]

> Setting aside legitimate (thats a matter of judgement)

By definition, a judge decides what's legitimate.

If DOGE expects their access to be blocked by a court judgement, and bum-rushes agencies to exfiltrate data ahead of the judgement, that's also criminal intent.

I am not sure what you are getting at. "Covert" isn't how I'd describe DOGE's actions. "Brazen" maybe?