Document Yr0yBxmdyRjLnkMaQzkDzL4Q8

RAND PAUL, KENTUCKY, CHAIRMAN RON JOHNSON, WISCONSIN JAMES LANKFORD, OKLAHOMA RICK SCOTT, FLORIDA JOSH HAWLEY, MISSOURI BERNIE MORENO, OHIO JONI ERNST, IOWA ASHLEY MOODY, FLORIDA GARY C. PETERS, MICHIGAN MARGARET WOOD HASSAN, NEW HAMPSHIRE RICHARD BLUMENTHAL, CONNECTICUT JOHN FETTERMAN, PENNSYLVANIA ANDY KIM, NEW JERSEY RUBEN GALLEGO, ARIZONA ELISSA SLOTKIN, MICHIGAN 'United *tato *cum COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS WASHINGTON, DC 20510-6250 March 24, 2025 The Honorable Sean Duffy Secretary Department of Transportation 1200 New Jersey Ave. SE Washington, D.C. 20590 Dear Secretary Duffy: I write to request documents and information regarding access to government systems by the office known as the Department of Government Efficiency (DOGE). Since January 23, 2025, employees working on behalf of the U.S. Digital Service (USDS), which the Administration is referring to as DOGE, have gained access to systems and databases at multiple federal agencies. Federal agencies, as part of their authorized activities, collect, maintain, and utilize an enormous amount of sensitive data to carry out their missions. This data can include personally identifiable information (PII) collected from the public, federal and contractor employee data, law enforcement sensitive data, and confidential commercial information, including from critical infrastructure operators. Failure to appropriately control access to this data creates significant privacy and security risks and may violate federal law. I write to request documents and information related to the work of USDS or DOGE, and the individuals -- including officials, contractors, and volunteers -- doing work on behalf of these agencies, to ensure compliance with all applicable security and privacy standards and laws. Please provide the following information and documents as soon as possible, but no later than April 11, 2025. Personnel 1. Provide a list of personnel operating under USDS or DOGE at Department of Transportation, including Department of Transportation personnel and personnel assigned to USDS or other agencies that are working at Department of Transportation on behalf of or otherwise supporting the activities of USDS or DOGE. 2. For each individual in (1), provide the following information: a. Position title and description; b. If applicable: Sierra Club v. Dept. of Transp. - 3:25-cv-06221 SC_EVERSPLIT0018949 i. Start and end date of employment; ii. Hiring Authority; iii. Employment classification; c. Functions and duties of that position (including the applicable authorizing statutes); d. Whether the individual has had a background check and if so, the level of background check; e. Whether the individual has a security clearance and if so, the level of security clearance; and f. Reporting structure of that individual within the agency (including the number of direct reports and supervisors). Systems and Data 1. List all agency information systems that have been accessed by a person affiliated with USDS or DOGE whether that individual is based in the agency or not. For each system accessed, please identify: a. The name of the USDS or DOGE-affiliated individual(s) who accessed the system and the type of access the individual(s) received; i. For individuals who received access to the categories of information described below, please explain the individual's need to know associated with this access and how it was tailored. b. Whether the system listed in response contains: i. Personally identifiable information (PII); ii. Sensitive PII; iii. Protected health information; iv. Confidential commercial information; Sierra Club v. Dept. of Transp. - 3:25-cv-06221 SC_EVERSPLIT0018950 v. Law enforcement sensitive data; vi. Controlled Unclassified Information; vii. Protected critical infrastructure information; viii. Inspector General information; or ix. Classified information. c. The data elements that individuals associated with USDS or DOGE requested access to, transferred, downloaded, modified, and/or combined with other data elements from agency or other federal systems. i. Identify the agency systems or other federal systems, and data elements, that USDS or DOGE combined. ii. Identify the mechanism used to transfer or download the data elements, including the security controls to ensure the confidentiality, integrity, and accessibility of the data. ci. For each system that includes PII, sensitive PII, and protected health intbrmation, provide the total number of individuals that had their information accessed by individuals affiliated with the USDS or DOGE, and provide a list of the PII and SPII in the system. cii. For each system that includes information collected from non-profit organizations and commercial entities, identify: i. The total number of non-profit organizations and companies impacted and the types of information included in the system. ciii. For classified systems, identify: i. The clearance level of the system; and ii. Specific precautions the agency took to ensure that access was only granted to authorized individuals with a valid security clearance and a need to know. Sierra Club v. Dept. of Transp. - 3:25-cv-06221 SC_EVERSPLIT0018951 2. If applicable, identify all data elements in Department of Transportation systems provided from outside of the agency, including other federal agencies, foreign governments, and state, local and Tribal partners, that may have been accessed, transferred, downloaded, modified, and/or combined by people affiliated with USDS or DOGE. a. For each of these data elements, identify whether there is a data sharing agreement with the external entity. b. For each data sharing agreement, was an analysis carried out to assess whether USDS or DOGE actions taken in regard to this data were within the terms of the agreement? i. If yes, please provide that analysis. 3. List all Artificial Intelligence (AI) tools and models that individuals affiliated with USDS or DOGE have used on agency data. Please include: a. All information on the procurement contract and use cases for the AI tools or models used. b. All information on security and privacy assessments of the tools or models used. c. Including all details on the security and privacy guidelines for the model 4. Provide documentation of any formal or informal agreements since January 20, 2025, to expand existing internal information sharing within the agency. a. List all agency systems and data elements subject to these agreements and identify the component(s) that have been granted access to each since January 20, 2025. b. Provide any assessments or analysis of the privacy impact of expanded internal information sharing since January 20, 2025. c. Provide any legal analysis related to the authority to expand internal information sharing since January 20, 2025. The Committee on Homeland Security and Governmental Affairs is authorized by Rule XXV (k)(2)(B) of the Standing Rules of the Senate to investigate matters that aid the Committee in "studying the efficiency, economy, and effectiveness of all agencies and departments of the Sierra Club v. Dept. of Transp. - 3:25-cv-06221 SC_EVERSPLIT0018952 Government."23 Under Senate Resolution 94, Sec. 12(e), of the 118th Congress, the Committee is authorized to review "the possible existence of fraud, misfeasance, malfeasance, collusion, mismanagement, incompetence, corruption or unethical practices, waste, extravagance, conflicts of interest, and the improper expenditure of Government funds."24 Please provide responsive documents and information as soon as possible, but no later than April 11, 2025. Thank you for your attention to this matter. Sincerely, Gary C. ters Ranking Member Committee on Homeland Security and Governmental Affairs zs S. Rule XXV(k)(2)(B). 24 S. Res. 94, Sec. 12(e). Sierra Club v. Dept. of Transp. - 3:25-cv-06221 SC_EVERSPLIT0018953