An NLRB security architect filed a complaint last week claiming that personnel from Elon Musk's Department of Government Efficiency (DOGE) extracted gigabytes of data from the agency's confidential case files during early March. According to the allegation, DOGE-affiliated accounts at the NLRB pulled down three code repositories from GitHub. Examination of one of these code packages reveals striking parallels to software released in January 2025 by Marko Elez, a 25-year-old DOGE staffer with prior roles across multiple Musk-owned enterprises.
Daniel J. Berulis, a 38-year-old security architect employed by the NLRB, submitted a formal whistleblower complaint detailing how DOGE representatives convened with NLRB leadership on March 3 and requested the establishment of several unrestricted "tenant admin" accounts designed to bypass standard network logging mechanisms that would otherwise document all user activity.
Berulis explained that these newly created DOGE accounts possessed full authorization to retrieve, duplicate, and modify data stored in NLRB systems. Additionally, the accounts could suppress logging visibility, postpone log retention periods, redirect logs to alternate locations, or delete them outright—privileges of the highest tier that neither Berulis nor his supervisor held.
The security architect discovered that one DOGE account had retrieved three external code libraries from GitHub that the NLRB and its service providers had never previously employed. A documentation file within one library indicated it was built to cycle through a broad range of cloud-based IP addresses functioning "as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing." Brute force operations involve systematic login attempts cycling through numerous credential combinations in quick succession.
Searching for this functionality on Google leads to a GitHub code repository belonging to a user named "Ge0rg3" who released a tool approximately four years prior called "requests-ip-rotator," marketed as a library enabling users "to bypass IP-based rate-limits for sites and services."
A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing
GitHub description of requests-ip-rotator
Ge0rg3's software is distributed as "open source," permitting anyone to copy and repurpose it for non-commercial purposes. A subsequent iteration of this project, designated "async-ip-rotator" and derived from Ge0rg3's original work, was uploaded to GitHub in January 2025 by DOGE official Marko Elez.
Elez, a prominent DOGE operative who obtained access to the Treasury Department's main payments infrastructure, has held positions across numerous Musk-controlled organizations, spanning X, SpaceX, and xAI. He ranked among the earliest DOGE personnel to draw public attention when The Wall Street Journal connected him to online statements endorsing racist and eugenic ideologies.
Following this public controversy, Elez stepped down from his position but was subsequently reinstated after President Donald Trump and Vice President JD Vance voiced their backing. According to Politico, Elez currently serves as a Labor Department representative assigned to multiple federal agencies, including the Department of Health and Human Services.
Politico reported that "During Elez's initial stint at Treasury, he violated the agency's information security policies by sending a spreadsheet containing names and payments information to officials at the General Services Administration," citing court documents.
KrebsOnSecurity reached out to both the NLRB and DOGE for responses and indicated it would provide updates if either organization replied.
The NLRB has been substantially incapacitated since President Trump dismissed three board members, stripping the organization of the minimum membership required for operations. Both Amazon and Musk's SpaceX have initiated legal action against the NLRB regarding complaints the agency submitted in labor disputes, contending that the NLRB's constitutional foundation is invalid. On March 5, a federal appeals court unanimously rejected Musk's argument that the NLRB's organizational structure breaches constitutional requirements.
Berulis's complaint states that DOGE accounts at the NLRB transferred more than 10 gigabytes of information from the agency's case database, which encompasses extensive confidential materials including records of workers seeking union representation and proprietary corporate documents. Berulis indicated he chose to disclose the matter publicly after superiors at the agency instructed him to refrain from notifying US-CERT, contrary to prior agreements.
Berulis expressed concern that the unauthorized data movement by DOGE might provide unfair benefits to respondents in multiple active labor proceedings at the agency.
If any company got the case data that would be an unfair advantage. They could identify and fire employees and union organizers without saying why.
Daniel J. Berulis
According to Berulis, the remaining two GitHub packages obtained by DOGE personnel included Integuru, a software framework engineered to analyze and reverse engineer application programming interfaces (APIs) that web platforms utilize for data retrieval; and Browserless, a "headless" browser designed for automating browser-dependent operations including web scraping and automated testing.
On February 6, an individual submitted a thorough and technical assessment of Elez's code on the GitHub "issues" section for async-ip-rotator, describing it as "insecure, unscalable and a fundamental engineering failure."
If this were a side project, it would just be bad code. But if this is representative of how you build production systems, then there are much larger concerns. This implementation is fundamentally broken, and if anything similar to this is deployed in an environment handling sensitive data, it should be audited immediately.
GitHub code reviewer
Following publication of this story, Elez's code repository was removed from GitHub. An archived version remains accessible.
Source: Krebs on Security