...
By Sophie Clark
Live News Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
A federal employee who described the Department of Government Efficiency's (DOGE) actions within the federal government has said he was stalked and threatened by an unknown person while he was compiling his disclosure on the department.
Daniel J. Berulis, an employee at the National Labor Relations Board (NLRB), came forward against recent activity by Elon Musk's DOGE because he said he was concerned its work at NLRB "resulted in a significant cybersecurity breach that likely has and continues to expose our government to foreign intelligence and our nation's adversaries."
Berulis' lawyer, Andrew P. Bakaj from Whistleblower Aid, disclosed: "While my client and my team were preparing this disclosure, someone physically taped a threatening note to Mr. Berulis' home door with photographs—taken via a drone—of him walking in his neighborhood.
Read More on News
"The threatening note made clear reference to this very disclosure he was preparing for you, as the proper oversight authority. While we do not know specifically who did this, we can only speculate that it involved someone with the ability to access NLRB systems."
Newsweek has contacted Bakaj and the White House via email for comment outside of regular office hours. Newsweek has also contacted DOGE via its X, formerly Twitter, account.
Why It Matters
Musk and DOGE have become increasingly unpopular among American voters. Since DOGE's launch, Musk and the department have faced mounting criticism over the firing of federal employees as well as concerns that Musk may eliminate vital public programs. The access to sensitive systems, namely within the Social Security Administration (SSA), that contain Americans' personal information also proved to be a cause for concern.
What To Know
The NLRB works to safeguard employee rights by regulating labor practices. It also holds sensitive data on unions and union membership across the country.
Berulis works in the IT department at the NLRB and brought his detailed concerns about DOGE's activities when it was given access to the NLRB's IT systems to Congress and the U.S. Office of Special Counsel, according to NPR.
His testimony, which was made public by exhibits provided by Whistleblower Aid, discloses that DOGE employees accessed the NLRB's IT systems on March 3.
He said the DOGE staffers arrived at the office in a black SUV with a police escort, and "interacted with only a small group of NLRB staff, never introducing themselves to those of us in Information Technology."
Berulis then said the DOGE staffers requested "the highest level of access and unrestricted access to internal systems" and were given "tenant owner" level accounts allowing them "essentially unrestricted permission to read, copy, and alter data." Berulis' team were told to "stay out of DOGE's way entirely."
He said that their access to these accounts "was not open to discussion."
Berulis explained that Microsoft's best-practices detail tenant accounts should "never be assigned to auditors because it can mask actions like creating or deleting accounts, changing role assignments, or altering policies and far exceeds any legitimate job need." He said it was now "impossible" for him to tell which accounts are being used by DOGE inside the system.
Although Berulis has worked in IT for 20 years, he says he was "directed not to resist them in any way or deny them any access."
The disclosure goes on to reveal that Berulis found odd occurrences in the NLRB's IT systems on March 5 and 6, including employees struggling to log into their accounts.
On March 10, Berulis found that controls to prevent insecure or unauthorized mobile devices from logging into "our tenant" were disabled and that internal alerting, monitoring systems, and multi-factor authentication systems were also changed.
He said he then saw a spike in "what appeared to be sensitive data leaving the secured location it is meant to be stored...that kind of spike is extremely unusual because data almost never directly leaves NLRB's databases."
Despite trying to track down more information about this data being removed from the NLRB site, Berulis says he was told the department did not have the capacity needed to detect or respond to "internal threat actors."
On March 11, Berulis and his team noticed a login attempt from an IP in Primorskiy Krai, Russia.
He said the Russian IP address was using a correct NLRB username and password and was coming from a newly created account used for other DOGE-related activity.
Berulis said there were more than 20 log-in attempts to this account, many of which occurred within 15 minutes of the account being created by DOGE engineers.
Berulis also witnessed a spike in billing inconsistencies.
According to his lawyer, the drone photographs taken of Berulis and his dog were sent to him while he was preparing his disclosure.
His attorney said: "While we do not know specifically who did this, we can only speculate that it involved someone with the ability to access NLRB systems."
He has requested a law enforcement and congressional investigation into who has access to private information on NLRB servers.
NLRB spokesperson Timothy Bearese told Newsweek: "The Agency can confirm Mr. Berulis is still employed at the NLRB but beyond that we have no further comment."
...
What People Are Saying
Andrew Bakaj, Whistleblower Aid disclosure: "Furthermore, on Monday, April 7, 2025, while my client and my team were preparing this disclosure, someone physically taped a threatening note to Mr. Berulis' home door with photographs—taken via a drone—of him walking in his neighborhood. The threatening note made clear reference to this very disclosure he was preparing for you, as the proper oversight authority. While we do not know specifically who did this, we can only speculate that it involved someone with the ability to access NLRB systems.
"This 'meat space' action—where a threat was physically delivered to my client's home—is absolutely disturbing in its manner and the implications suggested therein."
Daniel Berulis told NPR: "I can't attest to what their end goal was or what they're doing with the data, but I can tell you that the bits of the puzzle that I can quantify are scary...This is a very bad picture we're looking at."
White House spokesperson Anna Kelly told NPR: "It is months-old news that President Trump signed an Executive Order to hire DOGE employees at agencies and coordinate data sharing. Their highly-qualified team has been extremely public and transparent in its efforts to eliminate waste, fraud, and abuse across the Executive Branch, including the NLRB."
What Happens Next?
Berulis said he was providing all of the evidence he has, which is included in his disclosure, in order to facilitate an independent investigation into the IT systems at the NLRB.
Update 04/18/25 12:01 p.m. ET: This story was updated to include comment from Bearese.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines