What The Treasury Department Didn’t Say in Court.
The Extension of the TRO Limiting Access to Federal Payment Systems
This is an update to Privacy, The Trump Administration, and Musk Team’s Access to Federal Payment Systems.
As reported in Wired and elsewhere, the court has extended the temporary restraining order (TRO) prohibiting the DOGE Team's access to certain federal payment systems. Here's part of the reason why.
In opposing the continuation of the TRO, the Trump Administration submitted, among other documents, the Affirmation of Joseph Gioeli III, Deputy Commissioner for Transformation and Modernization in the Bureau of the Fiscal Service (Bureau or BFS), in the U.S. Department of the Treasury, February 11, 2025 (the "Gioeli Affirmation"). Mr. Gioeli appears from his affirmation to be a dedicated career civil servant, qualified by training and experience to, as his affirmation puts it, "oversee, among other things, the Bureau's Office of Information and Security Services (ISS). ISS promotes the integrity and operational efficiency of the federal government's financial infrastructure that is within Treasury's responsibility, while ensuring the security of that infrastructure and the information it contains."
The Gioeli Affirmation describes the safeguards taken to mitigate the risks of access to certain federal payment systems by the Treasury DOGE Team, limited for the moment to Tom Krause and Marko Elez, in terms that make the limitations of those safeguards clear. In his Affirmation, Mr. Gioeli acknowledged that access to these systems extends to “sensitive data elements," was “broader in scope than what has occurred in the past,” and that read-only access "does not fully eliminate the risks identified in the assessment."
The limitations are not the issue. The Gramm Leach Bliley requires banks to protect the same information using appropriate safeguards – consistent with other privacy laws. The question isn't whether the Treasury's safeguards are limited -- it is whether they are appropriate to the risks.
Safeguards are appropriate when they minimize the risks of whatever access is necessary to accomplish a stated purpose. That is why, despite some artful drafting, two omissions from the Gioeli Affirmation stand out.
Nowhere does the Gioeli Affirmation state that the safeguards that are and will presumably remain in place collectively minimize the risk that individual payee's social security numbers and bank account information will be disclosed to the Treasury DOGE Team; and
Nowhere does the Gioeli Affirmation explain why access to anyone's social security number or bank account information is required or useful to the "Treasury DOGE Team in understanding payment processes and identifying opportunities to advance payment integrity and fraud reduction."
These are assurances that the Treasury's knowledgeable security executive could not provide under penalty of perjury. It's what was left unsaid that counts.